What is a Botnet?
A botnet is a network of Internet-connected devices — PCs, servers, mobile and IoT devices — infected with malware and used to perform malicious activities, often unbeknownst to the device owners. Threat actors can use these networks to engage in activities such as sending spam, clicking on fraudulent ads and launching distributed denial-of-service (DDoS) attacks.
Once a device is infected, the malware communicates with its botmaster (also known as a bot herder) to receive new commands. The infected device then executes those commands to accomplish the attacker’s objectives. For example, a botnet infected with Mirai malware can be commanded to flood a targeted server or website with traffic, creating outages and revenue losses for the target.
In order to evade detection and disruption, bots communicate with their C&C servers using methods that are difficult for cybersecurity vendors or law enforcement agencies to detect and intercept. One common approach is to rely on the client-server model where bots communicate with a centralized server and share commands. In recent years, however, hackers have shifted to more sophisticated approaches that take advantage of peer-to-peer (P2P) technology.
To help prevent a device from becoming infected with malware, users should install updates for all software on their systems. Users should also watch for unusual activity on their devices such as a sudden increase in data usage, or a device that feels hot even when it isn’t being used. If suspicious activities are detected, restoring from a backup can reset the device to its original state and remove the malware.