What is Command and Control (C2)?

Command and control (C2 or C&C) is the infrastructure and protocols attackers use to talk to compromised devices after the initial infection. Through C2, they send instructions, update malware, steal data, and coordinate many hosts at once (for example as a bot network).

How C2 fits into an attack

Most campaigns follow a pattern: deliver malware or exploit a weakness, install a persistent agent, then open a channel home. That channel is C2. The agent “beacons” periodically: it checks in, receives tasks, and returns results. Without C2, many implants cannot adapt or exfiltrate data at scale.

Channels are chosen to blend in. Common choices include HTTPS to look like normal web traffic, DNS queries (including tunneling), and abuse of legitimate cloud or social APIs. Attackers also rotate domains (including domain generation algorithms), fast-flux DNS, and bulletproof hosting to stay online.

What defenders look for

• Regular outbound connections to rare domains or IPs
• DNS patterns that do not match normal clients
• New processes spawning network clients with no clear user action
• Egress filtering and threat intelligence on known bad infrastructure

Blue teams often combine network monitoring, endpoint detection, and DNS controls (sinkholes, filtering) to break or observe C2.

Why C2 matters for click fraud and ad fraud

C2 is the coordination layer for large automated operations. Infected PCs, phones, or embedded devices can receive tasks such as “visit these ads,” “submit these forms,” or “rotate through proxy endpoints.” That makes C2 relevant when you ask why click fraud and ad fraud scale: distributed clients need orders and updates. Understanding C2 also explains why IP blocks alone fail: the same botnet can shift endpoints and behaviors while the control plane moves.

For advertisers, the practical link is indirect but real: fraud vendors and platforms analyze traffic for automation, not just “bad IPs.” Signals like impossible timing and suspicious clicks complement network-level intelligence. Stolen data from C2-driven breaches can also enable account abuse that touches ad accounts and lead systems.