What is a Botnet?
A botnet is a collection of compromised devices that attackers hijack to commit cyberattacks and steal personal data. Hackers use them to mine bitcoin, launch DDoS attacks, and snoop on web traffic to spy on their victims.
Infected devices, known as bots, are controlled remotely by a criminal operator, often referred to as a bot herder. The threat actor uses malware to infect as many devices as possible and then enlists them in the botnet, which is controlled by a C&C server. The bots are dormant until a command is received, at which point they will execute their task. This can include scanning files, changing file permissions, managing user accounts, monitoring activity, collecting personal data, and downloading software that triggers secondary attacks.
The exact infection process varies, but it usually involves exploiting unpatched vulnerabilities, guessing weak or default passwords, using phishing to trick users into installing a malicious download, or taking advantage of exposed device management interfaces or services. After the device is compromised, the bot malware will attempt to “enroll” with the C&C server to begin communicating and receiving instructions.
The number of bots continues to grow and represent a significant threat to the resiliency of the Internet and the digital economy. A successful botnet attack can knock sites offline and cause major financial losses, but security teams are rarely aware that systems are infected. Controlled security testing including controlled C2 emulation, IoT and network device testing, egress and network segmentation testing and validation of security controls aligned to MITRE ATT&CK can help organizations identify gaps that attackers are likely to exploit.