Comparison of command and control (C&C) server tools in cybersecurity realm

Today, botnets are widely used in the most complex cyber-attacks. Although, in the past, botnets used in cyber-attacks established infrastructure for specific attacks developed, this is not the case today. Many botnet infrastructures implement Command and Control server frameworks and manage the bot network with these tools. Command and Control server frameworks are commonly referred to as post-exploitation tools. It is utilized to gather system information by executing various commands or scripts on the compromised system. In addition, it ensures persistence within the system, orchestrates horizontal and vertical attacks, distributes malicious software, and engages in harmful activities such as denial of service (DoS) attacks. Command and Control server frameworks differ in terms of the technologies used, the languages written in, the operating systems they are active in, the protocols they use in communication, the presence of user interfaces, and whether the communication is transmitted securely. In this study, the answer to the question "which is the best C&C server tool for a botnet?" was investigated and it was evaluated that there is no definitive answer. The study results show that although open-source software is mainly used in Command and Control server frameworks, commercial software is also present. In terms of interface, user-orientation and technical support, Cobalt Strike and Brute Ratel have been widely used. Empire and Caldera are open-source command and control framework tools, which stand out and are frequently used due to the interface and matching techniques used in attacks according to MITRE ATT&CK TTPs. In addition, it is observed that Windows is the primary operating system targeted through Command and Control server frameworks, while Linux and MacOS operating systems are also targeted at a lesser level.