What is a Botnet?
A botnet is a network of computers and other devices (often called bots) that have become infected with malware and are under the control of a malicious actor. The infected devices link back to a central server for instructions, and the attacker uses this massive collection of computing power to execute an attack. Attackers can use bots to accomplish a variety of tasks, including click fraud, ransomware distribution and distributed denial-of-service attacks.
Hackers recruit their bot army by infecting devices with malware via phishing, exploiting security gaps in software or websites, or through trojan horse viruses. Once a device is infected, the attacker installs bot-enabling software that connects to their command and control infrastructure.
The hackers then assign the bots various tasks, such as spamming or fraudulently clicking on ads or distributing ransomware. The bots then execute these tasks, sending the results back to the command and control server for review. The hacker can then analyze the data to make improvements to their botnet architecture or to launch a new attack.
Bots come in a variety of forms, and understanding the different types helps you detect, mitigate and recover from them more effectively. For example, centralized botnets like Conficker and Cutwail rely on a central command-and-control server that acts as a single point of failure. A more recent approach is to design botnets with peer-to-peer (P2P) components that allow each infected device to act as both a client and a server. This makes it difficult to take down the entire botnet at once.