C2 Server (Command and Control)
Incident ResponseA C2 (Command and Control) server is infrastructure operated by an attacker to communicate with compromised systems. It serves two functions: sending instructions to malware running on victim machines, and receiving exfiltrated data.
How C2 Works in Cloud Attacks
- Data exfiltration: stolen credentials are encrypted (often AES-256 + RSA-4096) and POSTed to C2 endpoints
- Domain mimicry: C2 domains often mimic legitimate services (e.g.,
models.litellm.cloudmimicking the reallitellm.ai) - Persistence polling: backdoors periodically check the C2 for new payloads to execute
- Kill switches: some C2 implementations include deactivation mechanisms
Detection in AWS
- GuardDuty: detects EC2 instances communicating with known C2 servers
- VPC Flow Logs: identify unusual outbound connections
- Route 53 Resolver DNS Firewall: block DNS resolution of known malicious domains
- CloudTrail: detect unusual API calls from compromised credentials
Related Content
Related Terms
An attack that compromises a software dependency, build tool, or CI/CD pipeline to inject malicious code into downstream applications and steal credentials.
The process of identifying potential security threats, malicious activity, and anomalous behavior in your AWS environment using automated monitoring tools.
KloudSec, built by the team behind Toc Consulting
See C2 Server (Command and Control) checked automatically, continuously
What you just read is a manual, one-time check. KloudSec runs this and 400+ more automated checks across 90+ AWS services, continuously, agentless, live in about 5 minutes.
Toc Consulting: AWS Security & Cloud Architecture
Securing your AWS estate?
Our team helps engineering teams secure and architect AWS the right way: assessment in week one, a prioritized action plan in week two.