What is a Botnet?
A Botnet is a group of systems that have been compromised with malware, enabling a cybercriminal to remotely control the devices. This allows the criminal to carry out a number of activities such as distributed denial of service attacks, spam e-mails, click fraud and cryptocurrency mining.
The device or systems that are part of the botnet may be compromised in a variety of ways, including by unknowingly visiting malicious websites or falling victim to phishing schemes. Internet infrastructure hardware like routers that enable and support your connection to the web can also be co-opted into a botnet. It is increasingly easy for hackers to find and exploit vulnerabilities in a wide range of devices that are connected to the internet. For example, NPR recently reported on how a seemingly innocent internet-connected toaster can be turned into a botnet.
Once the hackers gain access to a network of compromised devices, they can start the process of remotely programming them. The first step is to infect the maximum number of devices possible. This can be achieved by targeting devices that don’t receive regular security updates. Cheap and unsupported hardware is especially vulnerable.
Once a device is infected, it will begin to send back information to the hacker and wait for commands. The first generation of botnets worked with centralized command-and-control servers that managed the entire botnet. These are now largely replaced by P2P botnets that communicate with each other and rely on self-updating capabilities to detect other infected machines.