Botnets

A botnet is a network of computers or devices that have been compromised and are remotely controlled by an attacker. Bot malware creates hidden agents on each device, enabling a central or distributed command structure. Botnets typically include a mix of personal computers, servers, and Internet of Things devices, all under the control of a botmaster or bot herder who issues coordinated instructions.

Botnets communicate with one or more command-and-control channels. Early networks relied on centralized controllers such as IRC or single servers, while modern variants often use HTTP-based C2, peer-to-peer topologies, or fast-flux techniques to avoid easy takedowns. Infected devices become bots that report status and execute commands, sometimes updating malware to evade security measures.

Common activities include distributed denial of service (DDoS) attacks, large-scale spam campaigns, credential harvesting, data theft, click fraud, and cryptocurrency mining. The Mirai botnet, which scanned for IoT devices with weak passwords, became infamous for massive DDoS assaults in 2016. Other notable botnet families include Zeus (Zbot), TrickBot, Emotet, and various IoT-focused networks.

Prevention and response emphasize endpoint hardening and patch management, disabling unnecessary services, strong authentication, and intrusion detection to identify unusual beaconing or traffic to known C2 servers. Network defenders use sinkholing, takedown operations, and law enforcement collaboration to disrupt botnets. Individuals can reduce risk by updating devices, securing default credentials, and monitoring network traffic for anomalies.