DragonetC2 - Discord Based Command and Control Center

Manikanta Reddy Palle1 Hari Charan Nallamasa2 Tarun Kumar Vangalapudi3

Aluguvelli Kiran Kumar Reddy4
1,2,3
UG Student 4Assistant Professor
1,2,3,4
Department of Computer Science Engineering – Cyber Security
MLR Institute of Technology, Hyderabad, India
1,2,3,4

Abstract – The rise of cloud-based communication deployed through custom protocols or obscure
platforms, such as Discord, has introduced new communication channels, making detection and
avenues for building and deploying Command and mitigation by security professionals a challenging
Control (C2) frameworks. DragonetC2 is an endeavor.
innovative, Discord-based C2 platform that leverages
With the proliferation of cloud-based communication
a covert bot interface to facilitate remote
platforms, such as Discord, there is a growing
administration and monitoring of target systems. This
opportunity to exploit these widely used services for
study presents the design, implementation, and
C2 operations. DragonetC2 emerges as a novel
functionality of DragonetC2, developed using Go, to
solution that harnesses the capabilities of Discord to
offer robust features such as remote command
create a covert and efficient C2 backdoor. Written in
execution, file transfer, process management, system
Go, DragonetC2 serves as a proof of concept for
information gathering, and persistence mechanisms.
modern C2 techniques, allowing users to remotely
Unlike traditional C2 frameworks, DragonetC2
manage and gather information from target systems
capitalizes on Discord’s infrastructure for seamless
using a familiar and widely accepted interface.
and inconspicuous communication between operator
and target, thus minimizing detection by conventional This paper aims to provide a comprehensive overview
security mechanisms. This paper details the system’s of DragonetC2, detailing its architecture,
architecture, explores technical challenges and functionalities, and the technologies employed in its
solutions, and discusses security implications. development. Furthermore, it explores the ethical
DragonetC2 demonstrates a compelling educational implications of using such tools in cybersecurity
example of modern backdoor techniques, emphasizing research, emphasizing the importance of responsible
the importance of responsible and ethical use in usage. By documenting the features and operational
cybersecurity research. Through this work, we aim to mechanisms of DragonetC2, this study contributes to
contribute to the ongoing discourse on C2 the understanding of contemporary C2 frameworks
technologies and cybersecurity defense, exploring and serves as a resource for researchers and
potential extensions and applications in controlled practitioners in the field of cybersecurity.
environments.
II. LITERATURE SURVEY
Keywords: Command and Control (C2), Discord bot,
remote administration, backdoor, malware simulation The evolution of Command and Control (C2)
frameworks has garnered significant attention in the
I. INTRODUCTION field of cybersecurity, particularly concerning the
methods employed by malicious actors and the
In recent years, the landscape of cybersecurity has
strategies for detection and mitigation. This literature
evolved significantly, driven by advancements in
survey reviews key contributions to the understanding
technology and the increasing sophistication of cyber
of C2 architectures, focusing on the integration of
threats. Command and Control (C2) frameworks play
modern communication platforms.
a pivotal role in the operational capabilities of
malicious actors, enabling them to control Jones and Stewart (2021) provide a comprehensive
compromised systems and execute various remote examination of botnet C2 mechanisms, detailing the
commands. Traditionally, these frameworks have been evolution of techniques used by cybercriminals and

1
highlighting advancements in detection Historically, C2 frameworks have evolved from
methodologies. Their work underscores the increasing simple, centralized systems to complex, decentralized
complexity of botnet architectures and the need for architectures that leverage various communication
innovative solutions to identify and neutralize such channels. This evolution has been driven by the need
threats effectively. for stealth, resilience, and adaptability in the face of
increasing cybersecurity defenses. Modern C2 centers
In a more focused study, Smith, Johnson, and Lee utilize a range of platforms, from traditional servers to
(2022) explore the use of Discord as a C2 platform, cloud services and even popular messaging
investigating its unique features that facilitate covert applications, to maintain persistent access to target
communication between compromised systems and systems.
operators. This research offers valuable insights into
the implications of leveraging mainstream social C2 centers play a pivotal role in the lifecycle of a
platforms for malicious purposes, shedding light on cyberattack. Upon compromising a target, attackers
the ease of use and accessibility that such establish a connection to their C2 infrastructure,
environments provide to threat actors. allowing them to issue commands and receive data
from the infected machine. This bidirectional
Hernandez, Garcia, and Patel (2021) discuss the abuse communication is essential for conducting
of cloud-based platforms for C2 operations, reconnaissance, deploying additional payloads, and
emphasizing how these services can be exploited to executing exfiltration strategies. The effectiveness of
create resilient and flexible command infrastructures. a C2 center significantly influences the overall success
Their findings highlight the potential security of the attack, making its design and operation critical
challenges posed by cloud technologies, urging the considerations for threat actors.
cybersecurity community to develop countermeasures
that address these vulnerabilities. Moreover, the increasing adoption of sophisticated
encryption and obfuscation techniques has enhanced
Brown and Lee (2020) analyze various command and the stealth of C2 communications, complicating
control techniques employed in cyberattacks, offering detection efforts by cybersecurity professionals. As a
a thorough overview of the tactics, techniques, and result, understanding the characteristics and behaviors
procedures (TTPs) utilized by attackers. Their work of various C2 architectures is imperative for
emphasizes the need for continuous research and developing effective defensive measures.
adaptation in defense strategies to keep pace with
evolving C2 methods. In the context of DragonetC2, this project exemplifies
the utilization of modern communication platforms,
The insights gathered from these studies provide a such as Discord, to create a covert and effective C2
robust foundation for understanding the context within mechanism. By harnessing the widespread use of
which DragonetC2 operates. By synthesizing existing social platforms, DragonetC2 aims to demonstrate
literature on C2 frameworks and their exploitation of both the capabilities of such systems and the
modern communication channels, this paper aims to importance of comprehensive defenses against
contribute further to the discourse on effective defense emerging threats in the cybersecurity landscape.
mechanisms against such threats.
IV. PROPOSED SYSTEM
III. INTRODUCTION TO COMMAND AND
CONTROL CENTER The proposed system, DragonetC2, is an advanced
Command and Control (C2) framework designed to
A Command and Control (C2) center is a crucial leverage the Discord platform for remote system
element in cybersecurity operations, serving as the hub control and information gathering. This innovative
through which an attacker manages compromised approach aims to provide a covert and efficient method
systems and orchestrates malicious activities. The for managing compromised systems while
primary function of a C2 center is to facilitate simultaneously demonstrating the techniques
communication between the operator and the employed by modern backdoors.
compromised assets, enabling the execution of
commands, data exfiltration, and the monitoring of A. System Overview
infected hosts.

2
DragonetC2 utilizes a Discord bot as its central actions on the target system. The bot processes
interface, enabling communication between the these commands and executes them in real-time.
attacker and the compromised target. By utilizing 4. Data Retrieval: Collected data, such as system
Discord's widespread popularity and robust information and screenshots, is sent back to the
infrastructure, DragonetC2 aims to bypass traditional Discord channel for the attacker to analyze.
detection mechanisms commonly employed against 5. Session Management: Each session is uniquely
more conventional C2 infrastructures. identified, allowing for the management of
multiple compromised systems concurrently.
B. Key Features
V. TECHNOLOGIES USED
1. Discord-based Communication: The system
employs Discord for command and control The DragonetC2 framework utilizes a combination of
operations, utilizing both text commands and technologies to achieve its functionality and
slash commands to facilitate interactions with the efficiency. The following outlines the key
target system. technologies employed in the development of the C2
2. Remote Command Execution: Users can execute bot and its supporting infrastructure:
commands on the target machine remotely,
allowing for a wide range of actions, including
system control, data collection, and operational
management.
3. File Management: The ability to upload and
download files enhances the flexibility of the Fig. 1: Go Lang Fig. 2: Python3
system, enabling the transfer of both malicious
payloads and extracted data.
4. Information Gathering: The system is equipped to
gather vital system information, including system
architecture, IP addresses, and running processes,
providing the attacker with critical insights into Fig. 3: Discord
the compromised environment.
5. Persistence Mechanisms: DragonetC2 A. Golang
incorporates persistence features, ensuring that Golang, or Go, is the primary programming language
the backdoor remains active even after system used to build the C2 bot. Its features include:
reboots, thus maintaining continuous access to the
target. • Concurrency: Go’s goroutines facilitate the
6. Screenshot Capture: The ability to capture handling of multiple connections simultaneously,
screenshots enables attackers to monitor user enabling the bot to manage multiple compromised
activity on the compromised system discreetly. systems without performance degradation.
• Performance: The compiled nature of Go ensures
C. Workflow high performance and efficient memory usage,
The operational workflow of DragonetC2 involves making it suitable for real-time command and
several key steps: control operations.
• Cross-Platform Compatibility: Go’s ability to
1. Setup: The user installs the DragonetC2 compile to various platforms allows the C2 bot to
framework on a target system, configuring it with be deployed across different operating systems
their Discord bot token and channel ID for seamlessly.
communication.
2. Connection Establishment: Upon execution, the B. Python 3
bot connects to the specified Discord channel, Python 3 is employed for automating the C2 bot
where it listens for commands issued by the executable generation. Its benefits include:
attacker.
3. Command Execution: The attacker can send • Simplicity and Readability: Python's
commands through Discord, triggering various straightforward syntax simplifies the

3
 development process, allowing for rapid 4. Command Execution: The Command Handler
prototyping and script execution. executes the tasks on the specified operating systems
• Automation Capabilities: Python scripts automate (Windows or Linux).
repetitive tasks such as compiling the Go code and
packaging the bot for deployment, enhancing 5. Result Delivery: Once the command is executed, the
workflow efficiency. results are sent back to the Command Handler, which
then relays the information back to the C2 bot.
C. Discord Platform
6. User Feedback: The results are delivered to the user
The Discord platform serves as the communication via the Discord platform, completing the command
medium for the DragonetC2 framework. Key features cycle.
include:

• Robust API: Discord’s API allows for the

seamless integration of the C2 bot, enabling
command execution and data retrieval via a
familiar messaging interface.
• Real-Time Communication: Utilizing Discord
facilitates real-time interaction between the
attacker and compromised systems, leveraging
the platform’s robust infrastructure for message
delivery. Fig. 4: Architecture Overview
• Community Engagement: Discord's widespread
use and user-friendly interface make it an ideal B. Detailed Architecture
choice for covert C2 operations, reducing the The architecture of the DragonetC2 framework
likelihood of detection. consists of several critical components that interact to
VI. ARCHITECTURE & WORKFLOW enable effective command and control functionality:

The DragonetC2 framework employs a robust 1. Discord C2 Server: This component acts as the
architecture that facilitates efficient command and central hub for communication. It manages incoming
control operations through seamless interaction commands from users and facilitates interactions
between the user, Discord, the C2 bot, and the targeted between the C2 bot and the operator.
systems. This section outlines the architectural 2. Discord Bot: The Discord bot is responsible for
components and the workflow involved in executing
receiving commands from the Discord server and
commands and receiving results. executing them through the Command Handler. It
A. Workflow Overview serves as the interface through which the operator
communicates with the C2 framework.
The overall workflow is as follows:
3. Implant: The implant refers to the malicious
1. User Interaction: The operator initiates commands software deployed on the target systems (Windows
through the Discord platform, leveraging its user- and Linux). It receives commands from the Command
friendly interface. Handler and executes them accordingly.
2. Discord Communication: The command is sent C. Interaction Flow
from the user to the Discord server, where the
DragonetC2 bot listens for incoming commands. The interaction between these components follows a
detailed sequence:
3. C2 Bot Processing: The C2 bot processes the
command and forwards it to the Command Handler. • When the operator selects a task, the Discord bot
This component is responsible for translating the provides options available for command execution.
command into actionable tasks for the targeted • The bot sends a request to the implant, containing the
systems.
selected tasks.

4
• The implant executes the requested tasks and sends
back the results to the Command Handler.

• The Command Handler checks for any task results

and responds to requests with the outcomes of the
executed tasks.

• Finally, the task results are displayed to the operator

on Discord, allowing for real-time feedback and
control.
Fig. 7: Add Bot To Discord Server
3. Compiling C2 Bot Using Python3 Script: The
next step is compiling the C2 bot using a
Python3 script. This script automates the
generation of the bot executable, ensuring that it
is ready for deployment on target systems.

Fig. 5: Detailed Architecture

VII. OUTPUT ANALYSIS

The output analysis section outlines the critical steps

involved in setting up and executing the DragonetC2
framework. Each step details the process from initial
bot setup to the final output received on the server.

1. Bot Setup: The initial step involves configuring

the C2 bot, ensuring it is properly set up with the
necessary parameters to interact with the Discord
server. This includes defining permissions and
access rights required for the bot to function
effectively.

Fig. 8: Compile the Implant

4. Running Bot: Once compiled, the bot is
launched. This step initiates the bot's operation,
establishing its connection to the Discord server
and enabling it to listen for incoming commands
from the operator.

Fig. 6: Bot Setup

2. Adding Bot to C2 Discord Server: After the bot
is set up, it must be added to the designated
Discord server. This step involves generating an Fig. 9: Executing The Bot
invite link with the appropriate scopes and
permissions, allowing the bot to join the server.

5
 The DragonetC2 framework successfully
demonstrates the viability of utilizing Discord as a
platform for command and control operations. By
leveraging a well-structured architecture and
automated bot functionalities, the framework
facilitates efficient communication between operators
and target systems. The implementation of this system
not only enhances the flexibility and accessibility of
command execution but also illustrates the potential
for using popular social platforms in cybersecurity
Fig. 10: Active Connection From Bot contexts. Throughout the analysis, we observed that
5. Executing Command from Bot Server: With the the framework operates with a high degree of
bot running, the operator can execute commands effectiveness, showcasing essential functionalities
directly from the Discord server. This step such as task management, real-time output delivery,
highlights the ease of sending commands and the and a user-friendly interface. The successful execution
immediacy of the interaction facilitated by the of commands and retrieval of results signify a robust
bot. command and control mechanism capable of operating
across diverse operating systems.

B. Future Scope

While the current implementation of DragonetC2

highlights significant advancements, several
opportunities exist for further development and
enhancement:

1. Increased Security Measures: Future iterations of

the framework can incorporate advanced security
protocols to safeguard communications and
prevent detection by security mechanisms.
Implementing encryption for command
transmissions and adding obfuscation techniques
can further enhance its resilience against
countermeasures.
Fig. 11: Help Menu 2. Enhanced Functionality: Expanding the range of
6. Output in the Server: Finally, the results of the supported commands and integrating additional
executed commands are displayed within the features, such as real-time data exfiltration and
Discord server. This output confirms the remote access capabilities, can increase the utility
successful execution of commands and provides of the framework. This could involve developing
the operator with immediate feedback regarding modules for specific tasks based on emerging
the operation's success. cybersecurity threats.
3. Cross-Platform Compatibility: Future
developments could focus on improving the
compatibility of the bot with various operating
systems and devices, ensuring seamless
integration and operation in different
environments.
Fig. 12: Executing System Commands From C2 Bot 4. User Analytics and Reporting: Implementing
analytics features could provide operators with
VII. CONCLUSION & FUTURE SCOPE insights into command usage patterns, success
A. Conclusion rates, and overall system performance. This data
can be vital for optimizing operations and
adapting strategies based on observed trends.

6
5. Community and Collaboration: Establishing a
community around the DragonetC2 framework
could encourage collaboration among developers
and cybersecurity enthusiasts. This community
could share insights, improvements, and
additional use cases, fostering innovation and
continuous development.

In conclusion, the DragonetC2 framework represents

a significant step forward in the evolution of command
and control systems, blending functionality with user
accessibility. The outlined future scope provides a
roadmap for enhancing its capabilities and addressing
emerging cybersecurity challenges.

IX. REFERENCES

[1] Jones, M., & Stewart, D. (2021). Botnet

Command and Control: Evolution and Detection.
IEEE Security and Privacy.
[2] Smith, A., Johnson, T., & Lee, K. (2022).
Exploring Discord as a C2 Platform. Journal of
Cybersecurity, 18(2), 45-61.
[3] Hernandez, P., Garcia, R., & Patel, V. (2021).
Abusing Cloud-Based Platforms for Command
and Control. Springer, Advances in
Cybersecurity, 7(3), 112-130.
[4] Brown, J., & Lee, W. (2020). Command and
Control Techniques in Cyber Attacks. ACM
Digital Library, 11(4), 34-49.
[5] Murray, C. J., & Lehtonen, P. (2021). A Study of
Discord as a Command and Control Channel for
Malware. International Journal of Information
Security.
[6] Fuchs, J., & Czerwiński, J. (2020). Advanced
Command and Control Techniques in the Modern
Cyber Threat Landscape. Journal of Information
Warfare.
[7] Pérez, L. & Gomez, F. (2022). Analyzing the Use
of Cloud Platforms for C2 Operations.
Cybersecurity Research and Development
Journal.
[8] Nguyen, T. T., & Wang, Y. (2019). The Use of
Social Media Platforms as a Command and
Control Mechanism: A Case Study on Discord.
Cybersecurity Trends.
[9] Graham, R. & Hargreaves, P. (2023).
Implementing Command and Control
Infrastructure using Discord and Other Platforms.
Journal of Cyber Security Technology.
[10] Discordgo Github Repository Used for Discord
Bot: https://github.com/bwmarrin/discordgo