CyberGuard dictionary / Malware
Command and Control
Command and control is the communication channel or process through which an attacker directs compromised systems and receives information from them.
In simple terms
After malware runs, it may contact infrastructure controlled by an attacker for instructions or to report results.
Technical explanation
C2 can use web protocols, DNS, cloud services, or other channels, and may rotate destinations or hide inside ordinary traffic. Blocking one address can disrupt activity but does not prove the attacker has lost access.
Attackers use a communication channel to issue tasks, receive results, or update compromised software. Traffic may blend with normal web or cloud services, so context and timing matter.
Examples in practice
A compromised workstation periodically contacts a remote server to receive tasks and upload collected files.
A workstation contacts the same unusual domain every ten minutes and receives small responses. Analysts link the traffic to a new process and block the channel while preserving the host for analysis.
Why it matters
Recognizing C2 traffic helps identify active compromise and other affected devices.
VERIFY & LEARN MORE
Sources and further reading
Published 2026-10-15 · Last updated 2026-10-15 · CyberGuard editorial content. Source links provide context; they do not imply endorsement.