What is a Botnet?
A botnet is a network of internet-connected devices, including PCs, smartphones and IoT (Internet of Things) devices, that are infected with malware and controlled remotely by attackers or cybercriminals. The hackers control these devices using command and control software. The devices may be used to send spam emails, engage in phishing campaigns or perform distributed denial of service attacks (DDoS), and steal credentials.
Hackers recruit a collection of infected devices into the botnet by spreading malware through phishing emails, compromised websites or unsecured apps. They also target vulnerable IoT devices, which are often low-powered and have poor security features. Once infected, these devices can become zombies in the botnet and perform various tasks for the hackers, such as harvesting credentials, stealing sensitive data or executing CPU-intensive tasks.
The infected devices communicate with a central server, known as a C2 (command and control) server. This is where the infected device receives instructions on how to execute an attack. Infected computers can use established communication methods such as IRC networks or HTTP, or more sophisticated methods, such as encrypted email.
Cybercriminals can sell access to their botnets on a rental basis or for a one-time fee, and they can use them as tools to steal credentials or conduct e-commerce fraud. This includes credential stuffing and dictionary attacks, where cybercriminals attempt to brute force login passwords by testing all possible combinations until they find the right one. Other examples of botnet activities include ad fraud, click fraud and phishing attacks.