Technique
technique:command_and_control
Also: C&C, C2, C2 communication channel, command and control stuff
Remote control of a compromised computer through an installed implant.
Remote control of a compromised computer through an installed implant.
“The next phase of the cyber kill chain is command and control.”
Callback communications used by the penetration-testing team after gaining code execution.
“get the call backs going to command and control stuff”
Remote-control infrastructure used by the Litecoin-mining malware.
“Then the C2 was at some hosting company”
Remote communication used by malware to receive attacker instructions, including through Facebook fake accounts in the DropBook case.
“a C2 communication channel using Facebook fake accounts”
Centralized control of infected computers through command-and-control infrastructure.
“they all call back to that central command and control server for instructions”
Communication from compromised devices to attacker-controlled command-and-control servers.
“communication to known C2”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| incoming | USES | Nation State Actor | Explicit | 10 |
| incoming | USES | Mubix | Explicit | 22 |
| incoming | USES | Litecoin-mining malware | Explicit | 78 |
| incoming | USES | DropBook | Explicit | 89 |
| incoming | INVOLVES | Mariposa botnet | Explicit | 94 |
| incoming | INVOLVES | France's critical infrastructure compromise | Explicit | 94 |
Nation State Actor USES Command and control
The implant provides remote interactive access to the administrator's computer, which the episode identifies as command and control.
Explicit Confidence 99% · Jack Rhysider EP 10 Details
“we now have the ability to remotely access the network admin’s computer. This is our command and control over the target computer.”
Mubix USES Command and control
Mubix says the team established callbacks to command and control infrastructure.
Explicit Confidence 95% · Mubix EP 22 Details
“get the call backs going to command and control stuff”
Litecoin-mining malware USES Command and control
Int80 says the malware's command and control was hosted on a VPS.
Explicit Confidence 99% · Int80 EP 78 Details
“the C2 was at some hosting company”
DropBook USES Command and control
DropBook implements a command-and-control channel using fake Facebook accounts.
Explicit Confidence 99% · Assaf Dahan EP 89 Details
“they actually implemented a C2 communication channel using Facebook fake accounts”
Mariposa botnet INVOLVES Command and control
The Mariposa botnet relied on infected computers communicating with central command-and-control servers.
Explicit Confidence 99% · Jack Rhysider EP 94 Details
“Those servers they were reaching out to are known as command and control servers”
France's critical infrastructure compromise INVOLVES Command and control
The French critical-infrastructure compromise involved systems repeatedly beaconing to command-and-control domains.
Explicit Confidence 94% · Chris Davis EP 94 Details
“we noticed that it was also France’s rail system, hospitals, banks, water treatment systems.”