14. Modern C2 Evolution

14.1 Next-Generation C2 Frameworks

Framework	Characteristics
Sliver	Written in Go, modular, active community
Brute Ratel C4	Highly evasive, designed specifically for red teams
Mythic	Platform-based C2, supports multiple agents
Havoc	Open source, supports indirect syscalls
Cobalt Strike 4.x	Still mainstream but heavily signatured, requires extensive customization

GraphQL wrapping: disguise C2 commands as GraphQL API calls
WebRTC channel: use WebRTC's P2P nature to establish C2 (piercing NAT/firewalls)
QUIC protocol: UDP-based encrypted transport, hard to fingerprint
Domain fronting evolution: after CDN vendors tightened controls, shifted toward HTTP/2 multiplexing / SNI spoofing
Living-off-the-Land C2: Teams/Slack/Discord/Telegram Bot/Google Drive used as C2 channels

VPN devices (Fortinet/Palo Alto/Ivanti) → long-term persistence → man-in-the-middle traffic
Router implants → network sniffing / DNS hijacking
Firewall implants → rule tampering / traffic pass-through