In plain English
Once malware infects a device, it 'phones home' to a C2 server controlled by the attacker. This allows the attacker to issue commands, download additional tools, receive stolen data, or trigger actions like ransomware detonation — all while appearing to be legitimate web traffic. DNS filtering blocks known C2 domains before connections are established.
