What is a Botnet?
Botnets are networks of computers infected with malware under the control of a threat actor. The hacker, also known as a bot herder or botmaster, uses a command-and-control server to remotely administer the network of infected devices (zombie computers)—think of it like having an army of malicious hackers inside your network.
Cybercriminals build and use botnets for a variety of reasons. These include generating click fraud to earn advertising revenue, DDoS attacks that overwhelm websites and servers, collecting login credentials from victims for identity theft or financial gain, and mining cryptocurrency through secretly stealing computing resources.
To get started with a botnet, a hacker infects a computer or other device using malware distributed through phishing campaigns, exploit kits, and other attack methods. The malware then spreads through worm-like replication, targeting more devices and infecting them silently without the victim’s knowledge. Depending on the type of device, these may include desktop computers and laptops; mobile devices like smartphones or tablets; or even internet infrastructure hardware like routers.
Once a device is infected, it will monitor for instructions distributed by the bot herder’s command-and-control server (C2). When instructed, the malware will carry out the attack. Botnets can be centralized or decentralized—a centralized model connects all infected machines to a single C2 server, which makes management easy for attackers but leaves the entire network vulnerable to disruption through a single point of failure. Decentralized models, on the other hand, distribute instruction responsibilities across all zombie computers and allow them to act independently as both clients and servers—a more resilient design.