What is a Botnet?
A Botnet is a network of compromised devices controlled by a hacker (also known as a bot herder) to perform criminal activities such as sending spam emails, attacking websites with distributed denial-of-service attacks, and stealing data. Botnets exploit software and firmware vulnerabilities found on desktop computers, smartphones, tablets, Internet of Things (IoT) devices, and servers. They use malware that phones home to a central command-and-control, or C&C, server where the bot herder issues instructions to the malware.
The centralized client-server botnet model, popular during the first half of this century, relied on a single server to direct each of its clients to execute commands. Its drawback is that a single point of failure makes it easy for law enforcement to locate and destroy the botnet. Peer-to-peer (P2P) and decentralized C&C models have evolved to avoid this limitation by allowing each device in the botnet to act as both client and server, spreading instructions across a network. These networks are slower to deliver instructions, but provide extreme resilience against law enforcement takedowns and other attacks.
A botnet can be created using a variety of tools and attack methods including phishing, unpatched vulnerabilities, sketchy apps, and drive-by downloads on the Web. Once cybercriminals infect a device with malware, the malware will “phone home” to the C&C server and receive instructions for executing a particular task such as clicking on links or filling out forms. The malware will also scan the network for additional vulnerable devices and infect them with malware if possible.