What Is a Botnet?
A botnet is a network of enslaved devices that are remotely controlled by attackers. These networks can be used to carry out a wide variety of cyber attacks, including DDoS assaults, stealing personal account credentials, and more. Known for their ability to generate large volumes of traffic and sabotage the performance of services and websites, botnets are among the most dangerous types of malware.
To form a botnet, an attacker needs to infect at least one device with bot software. Once infected, the victim’s device — also called a zombie computer — will try to contact a remote website or server to retrieve instructions. These remote servers are often called command-and-control (C&C) servers.
These C&C servers can convey automated commands to infected devices via a communications protocol, such as Internet Relay Chat (IRC). Once the bot program is installed on a compromised device, it will often remain dormant and await orders from its C&C server before engaging in malicious activities or cyber attacks.
While centralized botnets use C&C servers to communicate, many hackers are switching to decentralized models that utilize peer-to-peer (P2P) networks to control infected devices. The P2P approach embeds the responsibility for communicating instructions in multiple bots, rather than just a few, making it difficult to identify and shut down the C&C. Using this strategy, attackers can spread their malware quickly and efficiently without losing control of the botnet. The Mirai botnet, for example, consists of IoT devices that have been hijacked by attackers to launch massive DDoS attacks.