What is a Botnet?
A botnet is a collection of computer systems (PCs, servers, smartphones, and Internet of Things (IoT) devices) infected with malware that allows attackers to remotely control them. Threat actors assemble these compromised devices into groups called bots, which are then used for malicious purposes such as launching distributed denial of service attacks (DDoS), stealing data, clicking on ads to earn revenue, phishing, cryptomining, and more. Bots typically gain initial unauthorized access via malware infections inflicted by phishing, drive-by downloads, malicious websites, and software vulnerabilities.
Once infected, the devices connect to a hacker’s server for instructions. The bot herder, known as a bot master, then directs the bots to perform malicious activities. The bots execute the commands in a coordinated manner to evade detection and disruption.
Bots are typically deployed against computer networks, but can also be used to target critical infrastructure. For example, the state-sponsored cyber espionage group Fancy Bear leveraged the Volt Typhoon botnet to target vulnerable Cisco and Netgear routers in 2021.
Bots often utilize advanced techniques to hide and evade detection, including polymorphic code, domain generation algorithms (DGAs), and encryption. This makes it challenging for signature-based antivirus and traditional network security hardware to detect them. Attackers deploy centralized and decentralized botnets. Centralized botnets are simpler to manage, but if the C&C server is disrupted, the entire network collapses. Decentralized botnets, on the other hand, operate over peer-to-peer (P2P) networks to communicate, with each bot acting as both a client and a server. This reduces the vulnerability to takedown attempts.