Reverse the server-client relationship. Clients have to constantly be up, servers communicate randomly, from different connections / ips / ports / protocols / and encryptions.

The only way you discover how to look is from others in the know. Once security is breached, you start over.

We used to do similar in the warez scene when it first moved from the bbs system to the internet, and before http was a thing. Telnet.