What is a Botnet and How Does it Work?
Imagine your laptop, smartphone or even your smart fridge working behind the scenes to follow commands from a remote attacker. That’s what happens when your devices are infected with malware and become part of a botnet. The network is used by cyber criminals to carry out DDoS attacks, spam email campaigns, phishing attacks and much more.
The underlying malware is spread through a variety of means including phishing emails, software vulnerabilities and exploiting default credentials on IoT devices. Once a device is infected, the malware can send and receive commands from a central server known as the command and control (C&C) server. The criminals who control the C&C server are known as the bot herder. The C&C server is the brain of the botnet, and it allows a criminal to send instructions to the infected devices.
Depending on the C&C server’s instructions, the botnet can perform various malicious tasks such as launching DDoS attacks to flood target servers and networks with traffic. It can also send out spam emails and steal online credentials, causing significant financial loss for businesses and consumers.
Various types of devices can be infected by different malware, and each botnet has its own unique structure. Older botnets typically use the client-server model where all bots connect to a centralized server to receive instructions. The drawback of this approach is that if the C&C server is discovered and disabled, the botnet becomes inoperable. Newer botnets, on the other hand, often operate over P2P to relay commands. This decentralized model is much harder to dismantle. Typical signs of infection include unusual network activity, software installations without consent and unauthorized CPU or memory usage.