DarkComet, like many other RATs, use a reverse-connecting architecture. The client is the system which is not infected with DarkComet. The client is the system with the GUI which controls the servers. The servers are all the infected systems. The servers do not contain a GUI.[6]
When DarkComet executes, the server connects to the client and allows the client to control and monitor the server. At this point the client can use any of the features which the GUI contains. A beacon goes off from the server every 20 seconds which waits for a command from the client.