What is a Botnet?
A botnet is a network of infected machines under the control of hacker that work together to carry out malicious activities like launching DDoS attacks, disseminating spam, or stealing data. A hacker creates a botnet by infecting computers, servers, or Internet of Things (IoT) devices with malware. The hacker, who is known as a bot-herder, then controls these infected machines (or “bots”) through centralized or decentralized command and control (C&C) servers.
Stage 1: Infection
Bot malware infections typically happen when hackers find and exploit a vulnerability, either through web downloads, exploit kits, popup ads, or email attachments. Once a device is infected, it becomes a zombie device that will act without the user’s knowledge and under the control of the bot-herder. The bot-herder then connects the devices to a C&C server using various protocols that are often enabled on corporate firewalls so messages won’t be blocked. Bots then wait for commands from the C&C server to carry out their tasks, such as a DDoS attack or sending spam.
While some bots may simply take advantage of a vulnerability to steal credentials and other data, others can launch sophisticated automated attacks. Common attacks include DDoS attacks, a form of traffic flooding designed to bring sites down, or phishing, which involves stealing data by impersonating trusted online resources. You might notice a botnet in your system when you experience an increase in bandwidth consumption, a drop in Internet speed, or unwanted changes to program settings or files.