What is a Botnet?
A botnet is a network of Internet-connected devices, typically computers or other machines, that are infected with malware and under the control of a malicious actor. The malware gives the actor the ability to perform a range of illegal or malicious activities, including spam, ransomware, fraudulently clicking on ads, distributed denial-of-service (DDoS) attacks and data theft. These attacks can cause significant outages and costs for businesses and are often carried out for profit.
Attackers can obtain the malware to infect devices by downloading it from compromised websites, exploit kits, popups, email attachments or social media links. Once the device is infected, it will communicate with a central server to obtain instructions — known as a command and control (C&C) system. These can be centralized via a client/server model or decentralized using a peer-to-peer (P2P) network approach.
Once instructed, the bot will execute commands. Bots can be programmed to remain dormant or actively harvest information, spam or perform a DDoS attack. The attacker can also hire the services of a bot herder to carry out an attack for a fee.
There are many ways to avoid botnet infection, such as installing patches for vulnerabilities, only purchasing trusted brands, avoiding open Wi-Fi networks and not clicking on suspicious links or opening email attachments. However, it takes a consistent effort to protect against increasingly sophisticated hackers who are willing to pay for the privilege of infecting thousands or millions of devices at once.