Overview
C2 frameworks are covered in most penetration-testing and red-team training paths because attackers use them to manage compromised systems. Understanding how they work is also valuable for defenders: if you know what the control traffic looks like, you can build better detection rules and response playbooks.
PhantomStack is my hands-on way to learn that. It is a small custom C2 research lab with three VMs: a target VM running a tiny agent, a redirector that handles Tor and mTLS, and a control dashboard. Everything is confined to an isolated VLAN that has no route to the internet or to my production network. The lab is only used for learning, never for unauthorized access.
Lab Setup
The lab runs on Proxmox and is separated from the rest of my network by OPNsense firewall rules. By default, nothing is allowed to leave the research VLAN, and the segment has no path to production systems or the public internet.
🖥 Operator Workstation
A hardened Linux VM used to build the agent, manage certificates, and review telemetry. Access is key-based only and restricted to the management VLAN.
🧪 Target VM
An isolated Windows VM that runs only the small research agent. It has no sensitive data, no internet browsing, and no connection to production resources.
🌐 Redirector / Transport VM
Routes C2 traffic through Tor and terminates mTLS. Acts as a chokepoint between the operator and the agent, simulating real-world redirector architecture.
🔥 OPNsense Segmentation
Firewall rules enforce strict east-west separation. The research VLAN cannot reach the standard network or management plane, and all inter-VLAN traffic is logged.
How Traffic Moves
The agent on the target VM sends short HTTPS check-ins through a local Tor proxy. The request travels over a Tor hidden service to the redirector, where mTLS checks the pinned client certificate. If the certificate is valid, the check-in is passed to the control dashboard. The dashboard can send back a task, and the agent returns the result the same way.
This layered approach is common in real C2 frameworks: Tor hides the network path, and mTLS hides the contents of the traffic even if someone monitors the circuit.
- Small agent on the target VM: runs inside an unprivileged process and checks in at jittered intervals
- Tor transport: the agent reaches the redirector through a hidden-service circuit, hiding endpoint relationships
- mTLS encapsulation: client and server certificates are pinned and verified before any C2 data is exchanged
- Session management: short-lived session tokens and irregular heartbeats reduce predictable network signatures
What I Learned
- C2 traffic has patterns: jittered timing, unexpected processes, and unusual outbound connections all stand out once you know what to look for
- Layered encryption matters: hiding the network path and encrypting the payload are two different defensive problems
- Segmentation limits blast radius: keeping the lab in its own VLAN means a mistake stays in the lab
- Detection opportunities: irregular heartbeats, Tor connections from non-Tor hosts, and pinned certificates in managed environments are useful indicators
- Building one improves defense: I now know what questions to ask during incident response and risk assessments
Ethics & Scope
PhantomStack is intentionally constrained. It never leaves the lab, never touches external systems, and never targets anyone without explicit authorization. The project is about learning how C2 infrastructure behaves so I can contribute to better detection, response, and risk assessment, not about building tooling for real-world targeting.
- All activity is confined to isolated VMs on a segmented, personally owned network
- No agents, binaries, or infrastructure are used outside the lab boundary
- The lab is powered off when not actively in use for research
- Findings are documented from a defensive perspective: network artifacts, behavioral indicators, and detection opportunities