Dismantling a Botnet
A botnet is a collection of malware-infected devices (or zombies) under the control of a nefarious remote attacker, also known as a “bot herder.” These bots can be used to carry out coordinated and large-scale illegal attacks at a scale impossible for individual pieces of malware.
Devices become infected with bot malware when users unknowingly download it, usually from unsafe apps or documents. Once infected, the devices connect to a command and control server controlled by the bot herder. They are then used to conduct nefarious activities at scale. Oftentimes, bots are employed to launch DDoS attacks against websites and online services. This type of attack can be devastating to businesses and disrupt everyday life for unsuspecting victims.
Other bots can be used to gather personal information or search for vulnerabilities in other devices. For example, the famous Mirai botnet infected IoT devices like routers, security cameras, and smart kitchen appliances by scanning the internet for IoT devices that use default factory passwords and other weak credentials. In general, bots can be used for a variety of illicit activities including ad click fraud, cryptojacking, and distributed denial-of-service attacks (DDoS).
Dismantling a botnet requires a layered cybersecurity approach that uses multiple defenses to address different levels of botnet architecture. For example, centralized botnets can be neutralized by locating and shutting down their backend servers. Decentralized botnets are more difficult to neutralize because they spread their activity across thousands of infected devices. For this reason, defenders should look for signals that a botnet is in operation: a jump in card testing or fake login attempts from a lot of different addresses, a low-and-slow attack pattern, and residential proxy traffic.