Sandworm: Application Layer Protocol and Web Emulation

Command and control (C2) is a crucial part of any cyber attack because it allows adversaries to establish and maintain communications with the systems they have compromised in a target environment. After an attacker successfully breaches a network or system, they need a reliable way to communicate with the malware or tools they have deployed. That communication channel is what C2 provides.

Without effective C2, attackers lose control of their operations. Adversaries depend heavily on this communication channel to persist in compromised environments — in effect, C2 is the lifeline that turns what could be a short-term breach into a long-term presence, enabling continued exploitation of the target over time.

To establish C2, adversaries use a variety of channels. One common technique is the use of legitimate remote access software such as VNC or TeamViewer. These tools provide an alternative communication channel, giving attackers redundant access, and they enable interactive remote desktop sessions that let an attacker directly control the target system.