What is a Botnet?
A botnet is a network of internet-connected devices — usually computers, servers, and IoT (Internet of Things) devices — that have been infected with malware. These devices are controlled by a hacker — or “bot-herder” — to inflict harm and commit fraud. Botnets enable criminals to spread malware faster and conduct large-scale cyber attacks.
In stage one, a hacker infects devices with malware, often using tactics like phishing emails and software and website vulnerabilities. Once infected, these devices – or “zombies” — await instructions from the bot-herder through a command and control (C2) server. When instructions are received, the zombie devices take various actions to aid in the hacker’s scheme. These activities can range from sending spam emails and distributing malware to launching DDoS attacks.
When a botnet is in operation, a victim may notice bandwidth consumption spikes or a decrease in internet speed. Another symptom is unexpected or unwanted changes to system files and accounts.
Some botnets use a client-server model where the bots connect to a central server and receive commands from the bot-herder. The C&C server then distributes the commands to the bots, which execute the commands and report back to the herder. Other botnets, such as the Mirai malware used to attack Github and DNS provider Dyn in 2017, use peer-to-peer (P2P) technology to distribute commands to the bots directly. This decentralized approach is harder to shut down than a client-server model. Moreover, P2P bots can be used to launch DDoS attacks against multiple targets simultaneously.