What is a Botnet?
A botnet is a network of infected devices that are collectively controlled by a single bad actor. Threat actors use botnets to conduct attacks that are both widely accessible and more effective than would be possible with an individual attack. A hacker could command all the computers in a botnet to simultaneously launch a Distributed Denial of Service (DDoS) attack, inject malware or harvest credentials.
To gain control over a device or multiple devices, a malicious actor deploys malware via viruses, worms, Trojans or exploit kits that take advantage of software vulnerabilities. These are often delivered through phishing emails, drive-by downloads or by accessing a compromised website. Once the attackers have gained control of a device, they can start to send commands to the botnet using covert channels. The bots then execute the malicious tasks and return information back to their master.
Most first-generation botnets operate on a centralized client-server model with one server controlling the entire network of infected devices. This model makes it easier to shut down the botnet by identifying and blocking its command-and-control (C&C) server. More sophisticated botnets operate on a decentralized peer-to-peer (P2P) system where each infected device acts as both a client and a server. This type of botnet is more resilient and harder to detect.
If you suspect your device is being used in a botnet, you will typically notice a sudden spike in bandwidth consumption or a drop in internet speed. You may also notice your accounts’ settings or file access preferences changing without you doing anything. Generally, botnets are used to harvest credentials for various purposes such as stealing credit card numbers or passwords, conducting DDoS attacks, spamming or cryptocurrency mining. Many of these attacks are for hire and offered online at low cost to malicious actors in regions where law enforcement is less capable or willing to intervene.