What is a Botnet?
A botnet is a group of hacked devices that work together to execute malicious tasks like sending spam or denial-of-service attacks. The devices can be traditional computers (PCs, laptops, tablets) or Internet of Things devices such as security cameras, thermostats, routers, and even baby monitors. Hackers infect the devices with malware, which is then used to gather data or execute commands. This data is sent to a command and control server or, in the case of P2P bots, to other infected computers. The person in charge of the entire network is known as a “bot herder.”
There are two types of structures that bot-herders use to manage their networks: centralized models and decentralized ones. In centralized botnets, one computer (called a zombie) serves as a client to the bot-herder’s remote server, which then communicates instructions to all other zombie devices on the botnet.
Cybercriminals usually build botnets for monetary gain. They can use a number of techniques to get their money, from clicking on online ads or downloading content to spamming victims with fake software updates or stealing credit card information. In some cases, they can even sell access to a portion of their botnet on the black market for significant financial gains.
Botnets can be difficult to take down because of the ways they communicate with each other. For example, older centralized botnets operate on a hierarchical model, which means that one server is the bot herder’s center of command and control, directing all bots lower in the hierarchy with instructions. Newer botnets, on the other hand, have a more decentralized model that uses peer-to-peer communication and other methods to obscure the bot herder’s identity and make it harder for investigators to track them down.