What is a Botnet?
A botnet is a network of infected devices that are controlled remotely by a cybercriminal. Using malware, the hacker connects thousands or millions of devices together to launch large-scale cyberattacks. They do this to take advantage of the combined computing power of these devices. These attack devices are known as zombies or bots, and they can be used for a variety of purposes such as performing distributed denial-of-service attacks (DDoS), steal data, send spam, or commit other malicious activities.
Cybercriminals can infect devices with botnet malware by exploiting a wide range of vulnerabilities. They may use phishing emails, software security gaps, or misconfigured IoT devices. Once they have a collection of bots, the attacker can rent access to segments of their botnet to others for financial gain.
Once the device has been infected, it will monitor for instructions sent by the bot-herder via a covert channel. These instructions are typically sent over the internet and are transmitted through a botnet’s command-and-control (C2) infrastructure. The C&C can be centralized, as in the client-server model, or decentralized through a peer-to-peer (P2P) system.
The client-server model is the most common. Each bot in the botnet must connect to a server in the network to receive new instructions. Identifying and shutting down one centralized server is much easier than stopping all the bots in a decentralized botnet. However, some bad actors may still prefer decentralized models because they are harder to detect.