What is a Botnet?
A botnet is a network of compromised computers or Internet of Things (IoT) devices that are under the control of a hacker, called a bot herder. The bots are used to carry out large-scale attacks through the pooled computational resources they make available. Hackers infect devices using software exploits, firmware exploits or malware downloaded through compromised links and files. Once a device is infected, it becomes part of the botnet and the hacker can remotely control it.
A typical botnet uses a centralized server that communicates instructions to the bots through covert channels. This server is known as a command and control (C&C) server. Bots on infected computers, or zombie computers, connect to the C&C server and spread the commands to other bots on the network. Cyber criminals use botnets for a variety of malicious activities including DDoS attacks, spam campaigns, data theft and cryptojacking. They also rent botnets as Botnet-as-a-Service for profit. Security researchers and law enforcement agencies try to disrupt botnets by identifying C&C servers, blocking command channels and seizing botnet domains. However, cybercriminals can quickly resurrect botnets with new infrastructure and malware variants.
The threat of being a bot can be reduced by keeping all software, including operating systems and browsers, updated, using antivirus and malware protection and installing updates as soon as they are available. Additionally, the best way to protect against becoming a bot is to prevent infections by staying aware of potential threats and taking precautions such as keeping all communications between the computer and the Internet encrypted with an ISP that uses a strong cipher suite.