Command and Control, or C&C, is the communication path attackers use to manage compromised systems. After malware infects a device, it often “phones home” to receive instructions, download additional payloads, update settings, or send stolen data back. C&C can be run from attacker-owned servers, but it may also hide inside legitimate platforms such as messaging apps, cloud services, or DNS traffic to blend in with normal network activity.
C&C matters because it turns a single infection into a remotely operated foothold. If defenders can identify and disrupt the channel, they can often limit what the malware can do even before the host is fully cleaned. In practice, analysts look for unusual outbound connections, repeated beaconing, unexpected use of web APIs, odd process behavior, and data leaving endpoints that should not communicate that way. Blocking known C&C infrastructure, monitoring endpoint telemetry, and hunting for abnormal polling patterns are common defenses.