What is a Botnet?
A botnet is a network of internet-connected computers, smartphones and IoT devices infected with malware that is controlled remotely by threat actors. They can then be commanded to do various tasks such as send spam, engage in click fraud and generate malicious traffic for distributed denial-of-service attacks. The device owners remain unaware they are being used in a cyber attack.
A hacker builds a botnet by infecting as many devices as possible with malware. This is often done by exploiting security vulnerabilities in software, websites and phishing emails. Once the bots are infected they become “robotic slaves” for the hacker, performing the desired task without the device owner’s knowledge or consent. Hackers can use a botnet to carry out a range of different cyber attacks for financial gain.
Typically, the hacker (also known as a bot herder or bot master) controls a large group of these bots through a communications protocol on a dedicated server called a command and control (C&C) server. These servers are commonly run on compromised machines or a mix of consumer and business computers. More advanced bots can communicate over a peer-to-peer (P2P) model and hide their identity from C&C servers.
Bots are behind a wide variety of dangerous and damaging cyber attacks including massive distributed denial-of-service (DDoS) assaults, mass email spam, data theft, form grabbing and other web scams. They can also be used to harvest keystrokes and steal personal account credentials that are then sold on the Dark Web for profit. To protect against a potential botnet infection, keep operating systems and risk prevention software up to date as well as exercise a healthy dose of digital skepticism.