What is a Botnet?
A botnet is a network of compromised devices, including PCs, servers, mobile and Internet of Things (IoT) devices, that are infected with malware. Threat actors, often cybercriminals, remotely control the infected devices – also known as “bots” – to execute malicious activities and attacks that remain hidden from the device owners. These attacks may include spam email campaigns, click fraud, and distributed denial-of-service (DDoS) attacks that generate large volumes of malicious traffic and render websites unavailable.
Generally, attackers infect computers and other devices with botnet malware through a variety of channels including exploiting website vulnerabilities, installing Trojan horse software, cracking passwords, or compromising unsecured devices such as routers and security cameras by exposing hardcoded firmware vulnerabilities. Once a device is infected, it will attempt to self-propagate by recruiting other devices that are part of the botnet.
The first generation of botnets typically operate on a client-server model where one command and control (C&C) server operates the entire botnet. This centralized model, however, is vulnerable to a single point of failure and is fairly easy for law enforcement to shut down.
Alternatively, more sophisticated malware can use peer-to-peer (P2P) technology to control infected devices. P2P botnets are harder to detect and take down because they use components of decentralized filesharing networks that allow each infected bot to be both a client and a C&C server at the same time. These bots probe random IP addresses looking for other infected bots that can provide them with instructions or updates.