Network component
network_component:command_and_control_server
Also: C&C, C&C server, C2, C2 infrastructure, C2 server, command and control, command and control servers
Server infrastructure used to remotely control the malware and compromised systems.
Server infrastructure used to remotely control the malware and compromised systems.
“The malware was being controlled remotely by a command and control server.”
Server infrastructure used by malware to receive commands and collect exfiltrated data.
“These are the servers that the malware actually talks to.”
Server infrastructure used by malware to communicate with attackers and receive or send data.
“This is usually done by a command and control server that’s controlled by the hackers.”
Server used to listen for connections from the executable placed on a USB drive during the prison penetration test.
“connect to our command and control server”
“This is the server that listens for when someone runs that executable on the USB stick.”
Central server used by infected systems to receive commands and return stolen data.
“Those servers they were reaching out to are known as command and control servers”
Server that communicates with and provides instructions to infected computers.
“This is what a command and control server is, something that can interact with an infected computer.”
Server infrastructure used by botmasters to send instructions to infected machines and receive feedback.
“Botnets are controlled through a command and control server, which I like to call C&C. Some people call them C2s.”
Server infrastructure used by ZeuS and related botnets to receive operator instructions.
“it dialed into the command and control servers to get instructions”
Server used to control infected systems and deliver or support malware such as Cobalt Strike and Conti.
“a command and control server — otherwise known as a C2 server”
Server infrastructure discussed as a possible control point for actively spreading ransomware.
“Sometimes there will be a vulnerability where we can hack into their command and control server”
“this is probably a command and control server”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| incoming | INVOLVES | Operation Manul | Explicit | 38 |
| incoming | USES | Regin | Explicit | 48 |
| incoming | USES | John Strand | Explicit | 67 |
| incoming | USES | Benjamin Donnelly | Explicit | 67 |
| incoming | USES | implant | Derived | 67 |
| incoming | USES | Cutwail | Explicit | 110 |
| incoming | USES | Conti | Explicit | 135 |
| incoming | USES | Cobalt Strike | Explicit | 135 |
Operation Manul INVOLVES command and control server
The campaign used command-and-control servers to communicate with the malware and receive stolen files.
Explicit Confidence 99% · Cooper Quinton EP 38 Details
“We started looking into the malware and we find the command and control servers.”
Regin USES command and control server
Regin uses command-and-control infrastructure to communicate with attackers and transfer collected data.
Explicit Confidence 95% · Jack Rhysider EP 48 Details
“the infected systems talk to each other first on the network and then through a central hub which then communicates back to the command servers”
John Strand USES command and control server
John and Ben monitor their command-and-control server for connections from the executable used in the prison test.
Explicit Confidence 99% · Jack Rhysider EP 67 Details
“John and Ben are in this coffee shop. They open up their computers and connect to their command and control server.”
Benjamin Donnelly USES command and control server
Ben connects to and monitors the command-and-control server with John during the prison penetration test.
Explicit Confidence 99% · Jack Rhysider EP 67 Details
“John and Ben are in this coffee shop. They open up their computers and connect to their command and control server.”
implant USES command and control server
The implant dropped by the USB executable is intended to create a remote connection monitored through John's command-and-control server.
Derived Confidence 88% · Jack Rhysider EP 67 Details
“the executable program on that USB drive tries to open a connection to John’s server.”
Cutwail USES command and control server
Cutwail contacted command-and-control servers controlled by Google for instructions.
Explicit Confidence 99% · Jack Rhysider EP 110 Details
“Cutwail contacts hardcoded IP addresses to talk to the C&C server controlled by the hacker Google.”
Conti USES command and control server
A command-and-control server was utilized by Conti to control infected systems.
Explicit Confidence 98% · Omar Avilez EP 135 Details
“a C2 server that was utilized by Conti”
Cobalt Strike USES command and control server
The Cobalt Strike implant communicated with Conti's command-and-control server.
Explicit Confidence 98% · Omar Avilez EP 135 Details
“a Cobalt Strike implant which was communicating to Conti’s C2”