What Is a Botnet?
A botnet is a network of compromised devices controlled by attackers for DDoS, spam, and credential attacks.
How Botnets Are Built
Botnet operators compromise devices through malware distributed via phishing emails, drive-by download attacks on compromised websites, exploitation of unpatched vulnerabilities in internet-facing services, and credential stuffing against devices with default or weak passwords. IoT devices — home routers, cameras, smart TVs, network storage devices — are particularly attractive botnet candidates because they are numerous, often run outdated firmware with unpatched vulnerabilities, and operate continuously without the security monitoring that protects corporate endpoints.
The Mirai botnet, which caused the 2016 Dyn DDoS attack that disrupted major internet services globally, infected IoT devices by scanning for devices using default factory credentials. Its source code was published online in 2016, spawning dozens of derivative botnets that continue to exploit default credentials on IoT devices.
Botnet Uses
DDoS attacks use botnet traffic volume to overwhelm targets with requests that legitimate infrastructure cannot handle. Spam botnets distribute billions of phishing and spam emails daily from compromised devices, bypassing IP reputation filters that would block known spam sources. Credential stuffing botnets distribute authentication attempts across thousands of IP addresses to defeat rate limiting. Proxy botnets rent access to their compromised device networks to other criminals, providing residential IP addresses that pass geolocation checks that datacenter IPs fail. Cryptomining botnets use compromised device CPU and GPU resources to mine cryptocurrency for the botmaster.
Botnet Defense
For organizations, botnet defense focuses on preventing corporate devices from being compromised and becoming botnet participants, and on blocking botnet-originated attack traffic. Endpoint protection with behavioral detection identifies botnet malware activity. Network monitoring identifies unusual outbound communication patterns associated with C2 beaconing. IP reputation services block known botnet infrastructure at the perimeter.
For IoT-heavy environments — manufacturing, healthcare, retail — IoT security management includes firmware update processes, network segmentation isolating IoT devices from corporate networks, and monitoring of IoT device communication patterns for anomalies indicating compromise.
Related Reading
What is a botnet?
A botnet is a network of compromised devices — computers, servers, IoT devices, mobile devices — controlled remotely by an attacker to conduct coordinated activities at scale. Each infected device, called a "bot" or "zombie," receives commands from a command-and-control (C2) infrastructure operated by the attacker. Botnets can include thousands to millions of compromised devices and are used for DDoS attacks, spam distribution, credential stuffing, cryptocurrency mining, and as proxy infrastructure for other attacks.
How are botnets created?
Attackers build botnets by mass-infecting devices with malware that establishes communication with C2 infrastructure. Infection vectors include exploitation of unpatched vulnerabilities in internet-facing devices (especially routers, IoT devices, and unpatched servers), credential stuffing against weak or default passwords on internet-exposed services, and trojanized downloads. The Mirai botnet, which caused the 2016 Dyn DNS DDoS attack that took Twitter, Spotify, and Reddit offline, exploited default credentials in IoT devices like CCTV cameras and home routers.
What are botnets used for?
The primary commercial uses are DDoS-for-hire services (renting botnet capacity to flood target infrastructure with traffic), spam and phishing email distribution, credential stuffing attacks (testing millions of breached credential pairs against target services), cryptojacking (using botnet compute for cryptocurrency mining), and proxy services (using compromised devices as anonymization layers for other attacks). Sophisticated botnets are also used by nation-state actors for espionage and intelligence collection at scale.
What is a command-and-control (C2) server?
A C2 server is the infrastructure attackers use to issue commands to compromised devices in a botnet. Modern botnets use sophisticated C2 architectures — domain generation algorithms that produce many possible C2 domains making takedown difficult, peer-to-peer architectures with no central server, fast-flux DNS that rotates IP addresses rapidly, and use of legitimate services (Twitter, Telegram, Discord, Pastebin) as C2 channels to blend with legitimate traffic. C2 takedown is one of the primary mechanisms for disrupting botnet operations.
What are the largest botnets in history?
Mirai (2016) infected hundreds of thousands of IoT devices and caused the largest DDoS attacks recorded at the time. Emotet (2014-2021) was a banking Trojan that evolved into a botnet-for-hire distributing other malware including Trickbot and Ryuk ransomware before international law enforcement takedown in 2021. Necurs distributed massive volumes of spam and malware before disruption in 2020. Conficker peaked at 11 million infected devices. Storm Worm had several million bots at its peak. Most are eventually disrupted by international law enforcement coordination.
How are botnets detected and disrupted?
Network monitoring detects characteristic C2 communication patterns — beaconing to suspicious domains, encoded traffic, communication with known malicious infrastructure. EDR detects the bot malware on infected endpoints. ISPs detect compromised customer devices through abuse complaints and traffic anomalies. Disruption typically requires international law enforcement coordination (Europol, FBI, national CERTs) combined with private sector threat intelligence (Microsoft, Mandiant, Cisco Talos) to seize C2 infrastructure, neutralize cryptographic keys controlling the botnet, and prevent re-establishment.
How can organizations avoid becoming part of a botnet?
Patch internet-facing systems promptly — unpatched vulnerabilities are the primary infection vector. Change default credentials on all devices, especially IoT, routers, cameras, and printers. Deploy EDR on endpoints to detect bot malware. Monitor network traffic for unusual outbound communication patterns. Segregate IoT and OT devices on isolated network segments. Implement DNS filtering to block communication with known C2 infrastructure. Establish incident response procedures for when a botnet infection is detected.
Real-World Example: Mirai Botnet Takes Down the Internet — 2016
On October 21, 2016, the Mirai botnet launched a massive DDoS attack against Dyn, a DNS provider whose infrastructure served major internet services including Twitter, Amazon, Netflix, Reddit, and GitHub. The attack generated approximately 1.2 Tbps of traffic from approximately 100,000 compromised IoT devices. Major internet services were disrupted for most of a day across the US East Coast. The attack demonstrated that compromised consumer IoT devices — security cameras, DVRs, home routers — represent collective attack infrastructure comparable to the most powerful DDoS capabilities previously available only to nation-states.
Devices estimated to be part of active botnets at any given time globally — including compromised home routers, IoT devices, servers, and personal computers, most of whose owners are unaware their device is participating in criminal infrastructure.