What is a Botnet?
A botnet is a group of computers, mobile devices or Internet of Things (IoT) devices infected with malware and controlled remotely by cybercriminals. The malware is used to do malicious things like send spam emails, harvest credentials, or execute CPU-intensive tasks on the infected device (“zombie”). Oftentimes, hackers use botnets for Distributed Denial of Service (DDoS) attacks and other automated cyberattacks to gain financial profits or steal information.
The malware that controls a botnet communicates with a central control server via network protocols such as IRC or HTTP. The bot herders then send instructions to the bots to carry out different tasks. Depending on the type of botnet, the herders may also be able to monitor the activities of the zombies through the use of proxy servers and DNS requests or by communicating directly with each device.
Compromised PCs and laptops are a popular target for botnets because they have high-speed connections to the internet and ample resources. However, bots can infect mobile devices such as smartphones and tablets or IoT devices with poor security like smart thermostats or cameras. Generally, the more devices in a botnet, the better the computing power and functionality that the attacker can acquire.
In addition to stealing money and data, some botnets are used to generate fake clicks on online ads. Other botnets, such as GameOver Zeus, are known for stealing credit card and banking credentials from victims and selling that information on the dark web for a fee.