What is a Botnet and How Does it Operate?
Most cyberattacks don’t originate from a single hacker sitting behind one computer. Instead, they depend on thousands of compromised devices working together without their owners’ knowledge to amplify the attack. These networks are called botnets, and they have become one of the most powerful weapons in modern cybercrime. They can support a variety of attacks, from distributed denial of service (DDoS) to credential stuffing and proxy abuse. The largest botnets – including the Aisuru, KimWolf and JackSkid networks that Qrator Labs observed in 2025 – can generate traffic spikes at 30+ terabits per second.
The three components of every botnet are the hacker who runs it (a ‘botmaster’ or ‘bot herder’), the compromised devices (‘bots’) and the network that connects them (the ‘command-and-control (C2) server’). All botnets run a small piece of malware that checks in with their C2 servers for instructions, then sends information back to the C2 when they complete tasks. Botmasters typically use encryption and obfuscation techniques to hide the code from researchers and evade anti-virus software.
Botnets are a clear and present danger to information systems. Security professionals need to understand how they operate in order to take effective action against them. Detection and mitigation techniques vary, but the most critical steps are understanding how to identify infected devices, removing them from the network and running security scans. Shared device traits – including fingerprints, headers and automation markers that show up across many machines – can reveal a single bot operator. Correlated device failures – such as spikes of failed login attempts or declines that cluster in time and reuse breach data – can also point to coordinated automation.