## 7 Comparison with Existing C2 Frameworks
Its strict licensing controls, restricting distribution to vetted organizations, have, unfortunately, contributed to the proliferation of cracked versions within underground communities. Sliver, being open-source, offers greater accessibility, though advanced customization requires familiarity with Golang. Mythic, while highly extensible, necessitates expertise in API-driven automation and scripting for maximizing its potential. Havoc, as a more recent framework, is still under development, but its modern approach to stealth and evasion shows promise for those willing to invest time in mastering its capabilities. C3 distinguishes itself through its ease of use. Its concise codebase facilitates modification and the addition of payloads and functionalities. Additionally, most C2 frameworks rely on heavy obfuscation techniques and large executable files. For example, a Sliver executable can be around 16 MB [17]. In contrast, C3 uses approximately 150 lines of code for the browser extension and 350 lines for the Native app, employs virtually no obfuscation, and only manages sub-processes, resulting in lightweight behavior and minimal execution overhead [18]. Furthermore, the performance of many C2 frameworks is impacted by heavy obfuscation and large executable sizes, with examples like Sliver reaching 16 MB [17; 18]. C3, on the other hand, is designed for efficiency, utilizing approximately 150 lines of code for the browser extension and 350 for the Native app. By employing minimal obfuscation and focusing on sub-process management, C3 achieves a significantly smaller footprint and reduced execution overhead, contributing to its optimized performance. In contrast to typical centralized C2, C3 employs a decentralized approach where each victim or group can communicate with a distinct C2 server. This is achieved through the browser plugin's ability to manage multiple communication endpoints (sub-domains/domains), each potentially linked to a different C2 server. Consequently, each plugin can probe these endpoints for active connections and communicate with an available server. Moreover, the plugin can be updated to modify these endpoints, allowing for dynamic C2 server switching. This inherent redundancy significantly enhances resilience and complicates defensive efforts by eliminating a single point of failure. From an OpSec perspective, selecting the appropriate C2 framework is contingent upon the specific adversary simulation objectives. Cobalt Strike remains a strong choice for well-resourced red teams requiring a comprehensive feature set and prepared to invest in extensive obfuscation and custom profiles for effective evasion. Sliver offers a compelling open-source alternative for those seeking cross-platform support and inherent evasion capabilities. Mythic is well-suited to teams prioritizing a modular and highly customizable approach. Havoc presents a promising option for those focused on modern evasion techniques, though further development is necessary to achieve feature parity with more mature frameworks. C3 provides a distinct advantage in operational security, leveraging its unique implementation to achieve a demonstrably low detection rate against prevalent EDR solutions. As already pointed out, in real-world attack scenarios, adversaries frequently employ multiple C2 frameworks to enhance their operational effectiveness. A common tactic involves utilizing one framework for initial access and reconnaissance, subsequently transitioning to another for post-exploitation and persistence. For instance, an attacker might leverage C3 to establish an initial foothold on a Windows server and then deploy Cobalt Strike for more extensive post-exploitation activities. Alternatively, they could initiate the attack with Mythic for stealthy initial access and subsequently pivot to a different C2 framework for lateral movement. By combining diverse frameworks, attackers can diversify their tactics and mitigate the risk of detection associated with reliance on a single, potentially monitored toolset.