Understanding C2 communication channels
After the initial compromise, threat actors need to communicate in some way with the victim host to be able to collect the necessary data, conduct reconnaissance within the network, and be able to spread to other hosts to achieve their main goal. Threat actors can use a variety of techniques for this communication, but their primary objective is stealth, as if they are easily detected in the initial stages of an attack, it could compromise their ability to further develop the attack. This is why most advanced threat actors seek to conceal communication with the control server by trying to disguise it as a legitimate activity, normal to the victim’s infrastructure. To do so, they may use, for example, the Application Layer Protocol (T1071) technique, using HTTP, HTTPS, DNS, or protocols from other layers of the OSI model, such as the network, transport, or session layers. In its report (https://www.group-ib.com/resources/research-hub/red...
