What is a Botnet?
Botnet is a network of hijacked Internet-connected devices that are controlled by a single cybercriminal (also known as a bot herder). Each compromised device, also called a zombie computer, is infected with malware to give the bot herder access and control. As a group, the bots can be used to launch attacks such as DDoS (distributed denial of service), mass email spam, malware infections and even financial breaches.
A central hub for the bots to communicate with one another is referred to as a command and control (C&C) server. These servers obfuscate the C&C traffic using various techniques to avoid detection. The most basic botnets use pre-configured Internet Relay Chat (IRC) servers and channels to send instructions, while others rely on HTTP to mask commands behind normal web traffic. Some recent botnets also take advantage of peer-to-peer (P2P) technologies to further obfuscate communications.
Attackers build botnets for a variety of reasons, but the most common are money and personal satisfaction. These attackers steal your data to monetize it or use it to spoof websites and services, distribute malware or run pump-and-dump stock scams.
The best way to protect against botnets is to ensure that your network’s ingress and egress controls are configured correctly and to monitor your devices for unusual behavior, such as slow reboot or shutdown times, excessive memory usage or other suspicious activity. Advanced cybersecurity tools can also detect and block a wide range of traffic anomalies including suspicious patterns that may indicate botnets.