What is a Botnet?
A Botnet is a network of different devices, like computers, mobile devices and even Internet of Things (IoT) devices that have been infected with malware and are under the control of a cybercriminal known as a bot herder. The malicious actions carried out by the devices, also known as bots, remain hidden to the device’s owner and are used for malicious activities like sending spam emails or launching distributed denial-of-service attacks.
A bot herder can gain control of a bot by installing the malware on a compromised system through file sharing, social media application protocols and email attachments. After being infected, the bots report back to the bot herder through a command and control (C&C) server using encrypted channels.
The C&C servers can be centralized or peer-to-peer. The former is more common and easier for cybercriminals to set up and manage. The latter is more difficult to identify and take down. As malware and hackers evolve, many are now moving away from centralized systems in favor of P2P models to make their botnets more resilient.
A centralized model still exists and can be used to detect bots and stop them from connecting to C&C servers. This involves blocking IP addresses, domains and ports associated with botnet communication. Network security teams must also ensure that they continuously monitor network traffic to detect and block attempts by the bots to reconnect with the C&C servers or to use alternative communications channels.