What is a Botnet?
A botnet is a group of Internet-connected devices that are infected with malware and controlled by a single attacker, known as the “bot herder.” The bots are used to carry out large-scale criminal actions such as spam emails, stealing user data, Distributed Denial-of-Service attacks (DDoS), crypto mining, and password cracking.
Hackers use a variety of techniques to infect victims with bots, such as web downloads, exploit kits, popup ads, and email attachments. Once a device is infected, it joins the botnet and begins sending commands back to the herder. Attackers can also scout out a victim’s device online and use methods like password cracking or credential stuffing to take advantage of weak user credentials.
In the past, hackers used centralized command and control servers to issue instructions to their bots. This slowed down their attacks because it was easy for law enforcement agencies and security vendors to locate the C&C server and shut it down. Today, many hackers are switching to a peer-to-peer (P2P) approach for controlling their botnets. This enables them to avoid detection and reduce the risk of a single point failure.
The P2P model works by connecting infected devices directly to each other, allowing them to share updated commands and update their malware. This is especially useful for attackers who launch a massive DDoS attack, which requires the coordination of thousands of compromised devices to hit their target with legitimate-looking traffic and knock it offline.