What is a Botnet?
A botnet is a collection of infected computers, Internet of Things (IoT) devices, smartphones or other connected gadgets that are controlled by malware to perform automated tasks such as harvesting credentials or conducting CPU-intensive attacks. The compromised devices, also known as bots, work together under the command of a cybercriminal, also called a “bot herder” to execute cyberattacks on a massive scale that would be difficult for them to carry out alone.
Threat actors usually use bots to gain access to personal and business user accounts. In order to do this, they first need to find a way to get into the target’s device. This can be done via phishing emails, software vulnerabilities or exploiting default credentials on routers and IoT devices. Once they have a compromised device, they can start scanning for vulnerabilities and infect it with bot malware.
The bots that are used to attack networks and websites are generally programmed to remain hidden from users and from systems processes that check for malicious code. They are also able to evade detection by constantly switching communication channels in order to avoid being detected by cybersecurity vendors and law enforcement agencies.
While good bots help with tasks such as speeding up search results, aiding customer service or directing traffic, bad ones contain malware and are controlled by hackers. Depending on the bots’ purpose, they can cause everything from e-mail spam to DDoS attacks that can cripple websites and cost organizations millions of dollars in lost revenues.