MuddyWater operators use a series of compromised websites that act as proxies in order to conceal the real address of the C2 server. Infected endpoints connect randomly to one of the proxy servers, which in turn relays the information to the C2. Operators use the C2 to dispatch commands and receive exfiltrated data