A command-and-control (C2) server is the infrastructure an attacker uses to communicate with compromised systems. Malware on an infected host checks in to this server for instructions, updates, payloads, or data exfiltration commands. In botnets and other malware campaigns, the C2 server acts like a remote control panel that keeps many compromised devices coordinated.
C2 infrastructure matters because it turns isolated infections into a managed operation. Attackers can change tactics quickly, push new malware, or selectively task only some hosts, making detection harder. Defenders look for signs such as regular beaconing, unusual outbound connections, suspicious DNS patterns, self-signed or mismatched TLS, and known malicious domains or IPs. Blocking or sinkholing C2 channels, isolating infected endpoints, and hunting for the associated malware are common response steps. In cloud and identity-focused attacks, C2 can also support credential checking, persistence, and lateral movement by coordinating stolen secrets and valid accounts.