What is a Botnet?
The botnet term is used to describe a collection of devices — computers, mobile phones and even Internet of Things (IoT) devices like smart cameras and thermostats — that have been enslaved by malware. Once infected, they can carry out a variety of automated tasks on a massive scale and often remain hidden from the device owners.
The hacker who controls the botnet, or “herder,” can use it to engage in a wide range of cyberattacks, including Distributed Denial of Service attacks, ransomware, cryptocurrency mining, identity theft and data breaches. Bots can also be used to hijack IoT-connected devices, overtake sensors and security systems and even delete a device’s firmware.
Threat actors can infect devices with botnet malware through tactics such as phishing attacks, software and website vulnerabilities and drive-by downloads. They may then exploit the infected device to perform a number of different functions, such as sending out spam messages, stealing personal information and generating fraudulent online traffic.
In order to operate, a botnet needs to communicate with its herder and receive instructions on how to infect additional devices. Traditionally, botnets were controlled using client-server models, where a specific domain or Internet Relay Chat channel that was controlled by the herder contacted the infected devices to both send and receive commands. However, as botnets have grown larger and have been targeted by global law enforcement and security agencies, herders have started to move away from this centralized control model. Instead, many bots now use a peer-to-peer (P2P) architecture that enables each infected device to function as both a server and client.