What is a Botnet?
A botnet is a network of infected computers or devices that work together to carry out an attacker’s goals. Attackers build botnets by infecting network-connected devices with malware, which then leverages the combined computational power of the devices to carry out attacks. Hackers use a variety of methods to infect devices, including software exploits and firmware exploits, malicious links or ads, and remote administration tools that come preloaded on some hardware.
Once a device is infected with botnet malware, it monitors for instructions from the bot herder. The herder can send the instructions to the infected devices through a variety of sources, including web content (including phishing attacks and spam), social media, DNS responses, and more. The malware then carries out the commands.
Malicious botnets are most commonly used for stealing data or causing outages, but attackers can also create a botnet to help test software or evade anti-virus detection systems. The most well-known example of a malicious botnet is Mirai, which targeted Linux IoT devices with default or weak credentials to launch massive Distributed Denial of Service attacks that temporarily shut down major websites and services such as Dyn.
While law enforcement and system administrators are constantly working to close down botnet control centers, the criminals behind these bots will continue to find new ways to gain access to Internet-connected devices and carry out their attacks. This is why it’s important for everyone to be vigilant with their online and device security, and to stay up to date on the latest methods to thwart cybercriminals.