A C2 server, short for command-and-control server, is the remote system malware uses to receive instructions and send back stolen data. After a device is compromised, the malware may contact this server to download new tasks, fetch plugins, or upload captured files, credentials, screenshots, or other sensitive material.
C2 infrastructure matters because it turns a one-time infection into an active operation. Defenders look for unusual outbound connections, suspicious domains, periodic beaconing, and encrypted traffic patterns that do not match the app or host’s normal behavior. Blocking, isolating, or sinkholing C2 servers can disrupt the attacker’s control, limit exfiltration, and reveal infected devices. In mobile theft cases, collected data is often forwarded to C2 infrastructure soon after it is gathered, making network monitoring a key detection point.