C&C increasingly uses encrypted HTTP connections, which are then used to connect to a frequently changing set of remote hosts to avoid observation, but use of Internet Relay Chat (IRC) vis port 6667 and similar techniques remain popular.