Botnet
A botnet is a network of internet-connected devices infected with malware that allows an attacker to control them remotely and en masse, typically without the device owners' knowledge, to carry out coordinated malicious activity.
Definition
A botnet is a network of internet-connected devices infected with malware that allows an attacker to control them remotely and en masse, typically without the device owners' knowledge, to carry out coordinated malicious activity.
Overview
A botnet forms when Malware infects a large number of devices — traditionally personal computers, but increasingly routers, IP cameras, and other Internet of Things (IoT) devices with weak default security — turning each into a "bot" or "zombie" that awaits instructions from an attacker, known as the botnet operator or "herder." Individual bots communicate with a command-and-control (C2) infrastructure, which the operator uses to issue instructions to some or all of the network simultaneously. Botnets are typically monetized or weaponized in several ways: launching Distributed Denial-of-Service (DDoS Attack)s by directing thousands or millions of bots to flood a target with traffic simultaneously, sending massive volumes of spam or Phishing emails, conducting large-scale credential-stuffing attacks against login pages, mining cryptocurrency using the victim's computing resources, or renting access to the botnet's infrastructure to other criminals as a service. Modern botnet command-and-control infrastructure has evolved to resist takedown efforts, using techniques like peer-to-peer communication between bots (removing any single point of failure), domain generation algorithms that produce large numbers of possible C2 domains to evade blocklists, and encrypted traffic that blends in with legitimate network activity. This resilience is why large botnets can sometimes persist and continue causing harm for years despite repeated law-enforcement and industry takedown attempts. Defending against becoming part of a botnet relies on the same foundational malware defenses — patching, Endpoint Detection and Response (EDR), and avoiding malicious downloads — with particular attention to IoT devices, which are frequently shipped with weak default credentials and rarely receive security updates, making them an outsized source of botnet infections relative to their individual computing power.
Key Concepts
- Network of malware-infected devices controlled remotely by an attacker
- Increasingly recruits IoT devices with weak default security, not just PCs
- Coordinated via command-and-control (C2) infrastructure
- Commonly used for DDoS attacks, spam, credential stuffing, and cryptomining
- Modern C2 infrastructure uses peer-to-peer and domain-generation techniques to resist takedown
- Can persist for years despite law enforcement and industry takedown efforts
- IoT devices are a disproportionately large source of new botnet infections