What is a Botnet?
A botnet is a collection of compromised devices infected with malware and controlled by a malicious attacker known as a “bot herder.” Attackers use various methods to deliver the malware to target users, such as drive-by downloads, email attachments, social engineering, or exploit kits. Once the malware is installed on a device, the attacker can then control it remotely through a command-and-control (C&C) server. Attackers are able to execute activities on the botnet, including distributing spam, conducting distributed denial-of-service attacks (DDoS), stealing sensitive information, and launching other cyberattacks.
The bot-herder communicates with the C&C servers through covert channels to instruct the malware to perform specific tasks. Infected devices, referred to as bots, can range from computers and cell phones to internet-connected cameras, routers, and IoT devices. For example, the Zeus botnet used malware to steal unauthorized bank transactions and other personal data, while the Mirai botnet infected Linux IoT devices such as security cameras, routers, and printers.
Detecting a botnet infection can be difficult because the malware may operate quietly, taking advantage of system resources to perform tasks such as cryptocurrency mining and sending spam. Observing unexplained changes in network traffic or data usage can help detect malware that is taking advantage of your system. A sudden increase in battery consumption or processor utilization could indicate that the device is working overtime for the botnet.
In addition to financial and legal risks, botnets can pose national security threats. Attackers can use them to infiltrate critical infrastructure and government networks, or deploy them in warzones to target adversary nations.