What is a Botnet?
A botnet is a network of computer devices or Internet of Things (IoT) gadgets infected with malware that allows cybercriminals to control them remotely without their owners’ knowledge or consent. Often, hackers infect computers and IoT devices with malware via phishing emails, software vulnerabilities or exploiting default credentials on routers and other networking hardware. Attackers, known as bot herders, use botnets to carry out various types of malicious activities including data theft, malware distribution and large-scale distributed denial-of-service (DDoS) attacks.
The bot herders typically communicate with infected devices by communicating with the device through a command and control (C&C) server. The C&C server receives instructions from the bot herder and then spreads those instructions to the infected devices. The botnet can then execute those commands, which can range from reconnaissance tasks to performing attacks or carrying out other malicious activities.
Often, attackers rely on freely available botnet malware to build their botnets. Examples include Mirai, which infected Linux IoT systems like routers and IP cameras to launch massive DDoS attacks that caused widespread outages of DNS provider Dyn and many other websites and online services. Other popular botnets such as Zeus and Emote are banking trojans that steal financial information from compromised machines through keystroke logging and form grabbing.
The motivations for building botnets vary, but usually involve stealing money, personal or business data, sabotage of services by taking them offline, and more. Despite efforts by cybersecurity researchers, law enforcement and system administrators to thwart cybercriminals, they continue to evolve their techniques to stay ahead of security measures and find new ways to infect and control devices.