What Is a Botnet?

A botnet is a network of internet-connected devices infected with malware and controlled remotely by an attacker through a command-and-control server. A botnet links compromised computers, servers, and connected devices into a coordinated group the operator directs without the owners’ knowledge. The Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) document botnets among the largest sources of distributed denial-of-service attacks and spam.

This article defines a botnet, explains how devices are recruited, describes the command-and-control models, lists what botnets are used for, gives examples including the Mirai and Emotet botnets, examines Internet of Things (IoT) botnets, and sets out the defenses. Each section states one part of the topic and connects it to the remote control at the center of the definition. The result is a complete, defensive account of what a botnet is and how to defend devices against botnet recruitment.

What Is a Botnet?

A botnet is a network of compromised devices controlled remotely by an attacker through a command-and-control server. A botnet combines many infected devices, called bots, into a single tool the operator commands. The defining traits of a botnet are listed below:

• Compromised devices are infected with malware that places each under an attacker’s control.
• Remote control lets an operator direct every device from a central command point.
• Command-and-control server sends instructions to the infected devices in the network.
• Coordinated scale combines the devices to produce attacks no single device could.

A botnet is built from devices infected by malicious software such as worms and trojans, making it one of the types of malware threats. The remote control that defines a botnet is the trait the following sections examine in detail.

How Are Devices Recruited Into a Botnet?

Devices are recruited into a botnet when malware infects them through worms, trojans, phishing, or exploited vulnerabilities, then connects each device to a command-and-control server. Botnet recruitment uses the same infection paths as other malware. The recruitment methods are listed below:

• Worm propagation spreads botnet malware automatically across networks to new devices.
• Trojan delivery hides botnet malware inside a program that appears legitimate.
• Phishing tricks a user into running the malware that enrolls the device.
• Exploited vulnerabilities let malware infect unpatched devices, including default-password IoT devices.

A device joins a botnet silently after infection, often by a computer worm that spreads the recruiting malware automatically. Devices with default passwords or unpatched firmware are recruited at scale, according to CISA advisories on botnet activity.

What Are the Command-and-Control Models of a Botnet?

The command-and-control models of a botnet are centralized, where bots connect to one server, and peer-to-peer, where bots relay commands among themselves. The model defines how an operator directs the botnet. The models are listed below:

• Centralized control connects every bot to a single command-and-control server that issues instructions.
• Peer-to-peer control relays commands between bots, with no single server to disable.
• Centralized models are easier to operate but fail if the central server is taken down.
• Peer-to-peer models are harder to disrupt because no single point controls the network.

A centralized botnet collapses when its command server is seized, which is why operators adopt peer-to-peer control to resist takedown, according to FBI botnet disruption reports. The model determines how defenders disrupt a botnet, since seizing a central server stops a centralized one.

What Are Botnets Used For?

Botnets are used for distributed denial-of-service attacks, sending spam, credential stuffing, cryptomining, and spreading further malware. A botnet applies its combined devices to tasks that require scale. The uses are listed below:

• Distributed denial-of-service (DDoS) attacks flood a target with traffic from thousands of bots at once.
• Spam distribution sends large volumes of email from the infected devices.
• Credential stuffing tests stolen username and password pairs across many sites using the bots.
• Cryptomining uses the combined processing of the bots to mine cryptocurrency for the operator.

A botnet supplies the distributed traffic behind a DDoS attack, multiplying what one device produces, one of the common network attacks botnets enable. Credential stuffing by a botnet tests stolen passwords at scale, which makes unique passwords and two-factor authentication effective defenses for individual accounts.

What Are Examples of Botnets?

Examples of botnets include the Mirai botnet, which infected IoT devices, and the Emotet botnet, which spread through email. A botnet example shows how compromised devices have been coordinated in real incidents. The examples are listed below:

• The Mirai botnet infected IoT devices with default passwords and launched record DDoS attacks in 2016.
• The Emotet botnet spread through malicious email attachments and delivered other malware to victims.
• The Conficker botnet grew from a worm that infected millions of Windows devices from 2008.
• The Mariposa botnet infected millions of devices to steal data before its operators were arrested.

The Mirai botnet, documented by CISA, used IoT devices with default credentials to launch one of the largest recorded DDoS attacks. The Emotet botnet spread through email and delivered ransomware and other payloads before an international operation disrupted it in 2021.

What Is an IoT Botnet?

An IoT botnet is a botnet built from infected Internet of Things devices, such as cameras, routers, and smart home devices, often compromised through default passwords. An IoT botnet exploits the weak security common in connected devices. The traits of an IoT botnet are listed below:

• Connected devices include cameras, routers, and smart home products with internet access.
• Default passwords on many IoT devices let malware infect them without cracking credentials.
• Infrequent updates leave IoT firmware vulnerable for long periods after release.
• Large scale arises because billions of IoT devices are connected worldwide.

The Mirai botnet demonstrated the scale of IoT botnets by infecting devices that still used factory-default passwords, according to CISA. Changing default passwords and updating firmware are the primary defenses for IoT devices, since weak credentials are the common entry point.

How Do You Defend Against a Botnet?

Defense against a botnet combines software updates, strong unique passwords, antivirus software, network monitoring, and changing default credentials on every device. Botnet defense both prevents recruitment and detects an infected device. The defenses are listed below:

• Software and firmware updates close the vulnerabilities botnet malware exploits to infect devices.
• Strong unique passwords replace the default credentials that IoT botnets exploit.
• Antivirus software detects and removes the malware that enrolls a device in a botnet.
• Network monitoring flags the unusual traffic an infected device sends to a command server.

Changing default passwords and updating firmware prevent most IoT botnet recruitment, according to CISA guidance. Detecting an infected device relies on antivirus software and on monitoring for the outbound connections a bot makes to its command-and-control server, supported by the steps to remove malware from a PC.

How Do You Know If a Device Is Part of a Botnet?

A device in a botnet shows signs such as slow performance, unexpected network activity, high data usage, crashes, and unexplained outbound connections. Botnet symptoms appear in performance and network behavior. The signs are listed below:

• Slow performance results from the device running botnet tasks in the background.
• Unexpected network activity appears as the device contacts a command-and-control server.
• High data usage rises as the device sends spam or attack traffic without the owner’s action.
• Frequent crashes occur as botnet malware consumes processing and memory.

Unexplained outbound connections to unfamiliar addresses are a common sign of a botnet infection, according to CISA. Detecting these signs relies on antivirus software and network monitoring that flags the traffic an infected device sends to its command server.

How Are Botnets Taken Down?

Botnets are taken down by seizing command-and-control servers, sinkholing the domains bots contact, and coordinating between law enforcement and security companies. A botnet takedown disrupts the control an operator holds over the infected devices. The takedown methods are listed below:

• Server seizure shuts down the command-and-control servers a centralized botnet depends on.
• Sinkholing redirects the domains bots contact to servers controlled by defenders.
• Law enforcement action arrests operators and dismantles the infrastructure behind a botnet.
• Coordinated disruption joins security companies and agencies to disable a botnet at scale.

The Emotet botnet was disrupted in 2021 through a coordinated international law enforcement operation that seized its infrastructure, according to Europol. A peer-to-peer botnet resists server seizure, which makes such botnets harder to dismantle than a centralized one.

What Is the Difference Between a Botnet and a Worm?

A botnet is a network of devices controlled by an attacker, while a worm is self-replicating malware that spreads on its own, and a worm is often the tool that recruits devices into a botnet. A botnet is the controlled network; a worm is one method of building it. The differences are listed below:

• A botnet is the network of compromised devices under remote control.
• A worm is malware that self-replicates to spread across devices.
• A worm can deliver the malware that enrolls a device into a botnet.
• A botnet uses its devices for coordinated attacks once recruitment is complete.

A worm and a botnet work together when a computer worm spreads the malware that connects each infected device to a command server. The worm performs the recruitment, while the botnet performs the coordinated attacks afterward.

Key Takeaways

• A botnet is a network of compromised devices controlled remotely by an attacker.
• Devices are recruited through worms, trojans, phishing, and exploited vulnerabilities.
• Command-and-control models are centralized, using one server, and peer-to-peer.
• Botnets are used for DDoS attacks, spam, credential stuffing, and cryptomining.
• Examples include the Mirai IoT botnet and the email-spread Emotet botnet.
• Defense combines updates, strong passwords, antivirus software, and network monitoring.

Last Thoughts on Botnets

A botnet is a network of compromised devices controlled remotely by an attacker through a command-and-control server, combining many infected bots into one coordinated tool. Devices are recruited through worms, trojans, phishing, and exploited vulnerabilities, and the operator directs them through centralized or peer-to-peer control. Botnets carry out DDoS attacks, spam, credential stuffing, and cryptomining, and examples such as Mirai and Emotet show their scale.

Defense combines software updates, strong unique passwords, antivirus software, and network monitoring. Readers can continue with the guide to common network attacks, the overview of malware, the explanation of a computer worm, or the introduction to cybersecurity.