What is a Botnet?
A botnet is a network of devices infected with malware and controlled remotely by threat actors. This expansive and versatile weapon provides adversaries with the ability to take down websites, harvest credentials and execute CPU-intensive tasks at scale.
Cybercriminals often spread the malware responsible for forming a botnet through file sharing, instant messaging protocols and other social engineering tactics. Once the malware infects a device, it reports back to its hacker controller or “bot-herder,” which in turn gives instructions to the compromised computer. The number of computers under control can grow to tens, thousands or even millions.
The hacker can then use the botnet to carry out DDoS attacks, mass email spam, financial breaches and more. The popularity of this type of attack has attracted many hackers because it can be extremely profitable if the botnet is large enough to generate high levels of income.
Bot herders can recruit their botnet from a wide range of internet-enabled devices, including traditional desktops and laptops, IoT devices like smart home systems, mobile phones and routers that enable and support internet connections. They can also rely on the proliferation of low-cost, low-security consumer devices that are becoming increasingly popular in workplaces and homes.
Botnets can be based on a client/server or peer-to-peer model. With a client/server model, one central server controls the communications between all the devices in the botnet. This approach has a single point of failure and makes it easier to locate the botmaster. Peer-to-peer models, on the other hand, offer a more resilient structure that is difficult to dismantle completely.