What is a Botnet?
A Botnet is a network of malware-infected computers (zombies) that are controlled by a single attacker known as the bot herder. These hackers often gain access to a device by exploiting vulnerabilities in software or hardware. Once they’ve gained access, the bad actor can steal data, resell it or send commands to the zombie devices to conduct various cyberattacks.
Hackers are using more and more types of devices to create massive botnets. This includes mobile devices like phones and tablets, as well as internet infrastructure hardware such as network routers. The technology market is flooded with cheap, low-security devices that are easy to infect and hijack.
After infecting a device, a malicious software programmed to work as a bot will monitor for instructions from a command and control server (C&C). Once it gets the instruction, the bot will transmit data back to the C&C server. It can also be programmed to perform specific tasks, such as sending spam emails, running brute force attacks or launching DDoS attacks.
Early bots were generally controlled from a single server, making them fairly easy to detect and take down. But more recent bots follow a peer-to-peer (P2P) model, where each infected device acts as both a client and a server and coordinates with other bots to pass commands. This makes them harder to track, but still able to carry out the same attacks. You can keep bots at bay by practicing good ingress and egress filtering practices to prevent them from entering your network.