Command and Control (C2)
Also known as: C2, C&C, Command-and-control server
Command and control (C2) is the infrastructure attackers use to communicate with malware on infected devices — issuing instructions and receiving stolen data. Infostealers exfiltrate stealer logs to C2 servers or, increasingly, directly to Telegram channels.
What is command and control?
C2 refers to the servers and channels through which malware receives commands and sends back data. For infostealers, the C2 is where harvested credentials, cookies, and files are uploaded after collection.
C2 in the infostealer ecosystem
Many infostealers now use Telegram bots and channels as a lightweight C2 and distribution mechanism, simplifying operations for affiliates. Others use traditional web servers, sometimes hidden via techniques like Vidar's dead-drop resolving.
VantaPrism monitors the Telegram channels widely used as infostealer C2 and distribution, capturing the stolen data as it is exfiltrated.
Check Your Exposure arrow_forwardFrequently Asked Questions
Where do infostealers send stolen data?
Related Terms
Infostealer malware is a category of malicious software designed to silently harvest sensitive data — passwords, sess…
A stealer log is the package of data exfiltrated from a single device by infostealer malware. It typically contains s…
Vidar is a long-running infostealer, derived from the older Arkei stealer, that collects browser credentials, cookies…
A log cloud is a subscription service — usually run through Telegram channels or dark-web panels — that gives crimina…