Academy
TermInfrastructure

Command and control server

(C2)

The server through which the attacker communicates with infected devices: stolen data is sent here, and new commands and additional payloads are received from here.

Flow

  1. 1Finds the address
  2. 2Gets the configuration
  3. 3Sends the data
  4. 4Downloads more payloads
Related families
Lumma Stealer, Vidar, Raccoon Stealer
MITRE ATT&CK
TA0011 · Command and Control
Sources
10 sources
01

Overview

MITRE ATT&CK defines command and control as a separate tactic: the ways an attacker communicates with and manages compromised systems. Attackers usually try to make this traffic look like ordinary network traffic. MITRE ATT&CK

For infostealers, the C2’s job is short but critical: passwords, session cookies and wallet data collected from the device are sent to this server in a single package. The attacker views the data in a management panel, then filters, sells or uses it. MITRE ATT&CK

02

How it works

  1. 1

    Finds the address

    The malware carries the C2 address within itself or reads it from text on a legitimate page such as a Steam profile or Telegram channel. This intermediate point is called a “dead drop resolver”; when the address changes, only that text is updated. MITRE ATT&CK

  2. 2

    Gets the configuration

    Some families learn what to collect from the server: which browsers, which wallets, which file extensions. The second version of Raccoon gets its configuration from the C2. Malpedia (Fraunhofer FKIE)

  3. 3

    Sends the data

    Collected data is usually sent as a single archive with HTTP or HTTPS requests that look like ordinary web traffic. MITRE ATT&CK

  4. 4

    Downloads more payloads

    The server can make the device download a second malware. An infostealer infection can thus become a door for ransomware or a remote access tool. MITRE ATT&CK

03

Real-world examples

Lumma Stealer: infrastructure seized

Lumma Stealer profile

In May 2025, Microsoft’s Digital Crimes Unit, with a US court order, seized or cut off access to about 2,300 domains forming the backbone of Lumma’s infrastructure. Microsoft said it had identified more than 394,000 Windows computers infected with Lumma worldwide between 16 March and 16 May 2025. Microsoft On the Issues

Lumma Stealer: the infrastructure returns

Lumma Stealer profile

After the operation, Lumma’s infrastructure was rebuilt. Seizing C2 domains alone does not end a family; the developer can carry on with new domains. Trend Micro

Vidar: C2 address in social profiles

Vidar profile

Vidar resolves its C2 address from text in Telegram, Steam or Mastodon profiles. It also downloads the legitimate libraries it needs (e.g. sqlite3.dll, nss3.dll) from the C2. Malpedia (Fraunhofer FKIE)

04

How to detect it

  • A process opening a Steam community profile or Telegram page and then immediately sending a POST request to an unknown domain is a typical trace of a dead drop resolver. MITRE ATT&CK
  • A non-browser process making a single large upload within a short time, especially to newly registered or CDN-fronted domains. MITRE ATT&CK
  • Connections to known C2 domains and IP addresses in threat intelligence feeds. MITRE ATT&CK
05

What to do

  • Match DNS and proxy logs against known C2 indicators; isolate and examine the matching device. MITRE ATT&CK
  • On a device that connected to a C2, consider the stolen data to have reached the attacker. Cleaning the device is not enough: change the passwords saved on it and end its sessions. MITRE ATT&CK
  • Limit internet egress from servers and workstations to the destinations they need; block direct egress to unknown domains. MITRE ATT&CK
06

MITRE ATT&CK

TA0011Command and ControlT1071.001Application Layer Protocol: Web ProtocolsT1102.001Web Service: Dead Drop ResolverT1041Exfiltration Over C2 ChannelT1105Ingress Tool Transfer
07

Related families and terms

Families

Lumma StealerActiveVidarActiveRaccoon StealerActive

Report

Infostealer Threat Report — October 2026

Terms

InfostealerData exfiltrationBotnet panel rentalIndicator of compromise
08

Sources

  1. 1Command and Control (TA0011) · MITRE ATT&CK
  2. 2Application Layer Protocol: Web Protocols (T1071.001) · MITRE ATT&CK
  3. 3Web Service: Dead Drop Resolver (T1102.001) · MITRE ATT&CK
  4. 4Exfiltration Over C2 Channel (T1041) · MITRE ATT&CK
  5. 5Ingress Tool Transfer (T1105) · MITRE ATT&CK
  6. 6Disrupting Lumma Stealer: Microsoft leads global action against favored cybercrime tool · Microsoft On the Issues, 2025-05-21
  7. 7Lumma Stealer returns · Trend Micro, 2025
  8. 8Vidar — family entry and report index · Malpedia (Fraunhofer FKIE)
  9. 9Raccoon Stealer — family entry and report index · Malpedia (Fraunhofer FKIE)
  10. 10Filter Network Traffic (M1037) · MITRE ATT&CK
From the Essential plan

Infostealer Detection

See your firm's attack surface on one screen: how many findings, at which severity, on which domain.

View productCompare plans