Definition:

A botnet is a network of connected devices that have been compromised and placed under a control system to perform coordinated actions. Each controlled device is known as a bot or zombie and may be a computer, server, phone, router, camera or another connected device.

The operator directs the network through command-and-control infrastructure. Device owners are commonly unaware that their equipment is participating. A botnet is not simply any collection of bots: in cybersecurity, the term describes a network that is normally controlled without authorisation to perform malicious or abusive activities.

How a botnet works

Creating and operating a botnet commonly involves three stages:

Recruitment: The attacker compromises devices through vulnerabilities, weak or default credentials, malicious files, phishing or other techniques. Installed malware provides continued access or executes instructions.
Command and control: Devices communicate with servers controlled by the operator or with other nodes in a distributed architecture. They receive instructions, configurations and updates through this infrastructure.
Execution: Nodes perform the assigned task, report results and may change targets. The operator can activate only part of the network or coordinate the entire botnet for a campaign.

A centralised architecture depends on one or more command-and-control servers. A peer-to-peer architecture distributes communications and can make the network harder to disable by blocking a single point. The NIST cybersecurity glossary provides reference definitions for this concept.

A bot can be legitimate and perform authorised automation. In a botnet, the nodes act together under a third party’s control. Compromised devices are also victims: participation in the network does not mean that their owners are voluntarily involved in an attack.

Uses of botnets

The same botnet can support several activities and change function when it receives new instructions:

Distributed denial-of-service attacks: Many devices send traffic or requests to a target to degrade or interrupt its availability.
Spam and malware distribution: The network can send spam, propagate malicious links, deliver files or help compromise more devices.
Data theft and fraud: Some nodes capture credentials, sessions or information, perform automated access attempts or participate in fraudulent operations.
Resource exploitation: A device’s processing power, connection or IP address can be used for unauthorised cryptomining, advertising fraud, proxy traffic or the resale of access.

Botnets can also be rented or divided between different campaigns. The harm is not limited to the activity’s target: recruited devices consume resources, expose data and may provide an entry point to other networks.

Botnet detection

Detection combines signals from the device, network and external services:

Anomalous communications: Periodic connections to unknown destinations, unusual DNS queries, unexpected outbound traffic or contact with infrastructure identified as malicious.
Device changes: Unknown processes or services, sustained resource use, modified security settings, update failures or activity while the device should be idle.
External indicators: Provider alerts, poor IP address reputation, unauthorised messages, unusual logins or notices that the device is participating in abusive traffic.

These indicators do not prove an infection on their own. Slow performance, fan activity or a pop-up window may have other causes. Confirmation requires correlating logs, processes, connections, security events and threat indicators.

Detection differs when an organisation is the botnet’s target rather than the owner of a compromised node. In that case, analysis focuses on distributed traffic patterns, request frequency, client behaviour and effects on service availability.

Response and prevention

The response depends on whether the affected party manages a compromised device or an attacked service:

Compromised device: It can be isolated from the network while the access mechanism is identified. Sessions and credentials need to be revoked from a clean device, the malware removed or the system reinstalled, the vulnerability corrected and malicious communications checked for recurrence.
Affected network or service: Controls may include filtering, rate limits, indicator blocking, segmentation and DDoS mitigation services. Coordination with connectivity, hosting or response providers becomes necessary when the activity exceeds internal capacity.

Prevention combines asset inventory, updates, removal of default credentials, stronger authentication, segmentation and outbound-traffic monitoring. A firewall can block particular communications but does not replace vulnerability remediation or investigation of devices that have already been compromised.