A botnet is a collection of internet-connected computers, servers, mobile devices, network appliances or other computing systems that have been compromised and placed under some degree of remote control by an operator. The individual compromised device is commonly called a bot or zombie, while the collection constitutes the botnet. A botnet does not necessarily consist of identical devices or use identical operating systems.
It can include ordinary desktop computers, cloud infrastructure, routers, cameras, digital video recorders and Internet of Things equipment. The defining characteristic is not the particular hardware but the unauthorised ability to coordinate multiple compromised systems as a group. Botnets are generally created through malware infections, exploitation of exposed services, stolen credentials, malicious downloads or exploitation of weakly secured devices. Once compromised, a device may continue functioning normally from its owner's perspective while silently executing commands issued by the operator. This makes botnets particularly significant because a single successful compromise can become part of a much larger distributed capability.
Botnets developed alongside the increasing connectivity of personal computers and the internet. Early botnets were relatively simple networks controlled through centralised command channels, often using Internet Relay Chat or similar mechanisms. Later generations adopted more resilient architectures, including peer-to-peer communication and dynamically generated communication mechanisms, making individual control servers harder to identify and remove. Botnet development has also followed changes in computing technology. As traditional desktop security improved, operators increasingly targeted poorly protected servers, routers and connected devices.
The Mirai malware family demonstrated the scale possible when large numbers of Internet of Things devices with weak or default credentials are recruited. Other botnets have focused on particular objectives, including distributed denial-of-service attacks, spam distribution, credential theft, malware delivery, fraud and unauthorised cryptocurrency mining. Botnets therefore represent an evolving operational model rather than one particular malware family. Their architecture, recruitment techniques, command mechanisms and objectives can change as defenders improve their detection capabilities and attackers identify new classes of vulnerable systems.
Recruitment is the process through which an attacker turns an ordinary device into a bot. Malware may exploit an unpatched vulnerability, guess or reuse weak credentials, abuse a malicious attachment, compromise a downloaded program, or exploit an exposed administrative interface. Automated scanning is particularly important because botnet operators can search enormous address spaces for devices exhibiting known weaknesses. After successful compromise, malware commonly establishes persistence so that the bot remains available after a reboot.
It may create services, scheduled tasks, modified startup mechanisms or other mechanisms appropriate to the operating system. Some malware also attempts to disable security software, remove competing malware or alter firewall settings. Recruitment does not always require sophisticated exploitation; poorly secured devices can sometimes be compromised through credentials that were never changed from manufacturer defaults. The resulting bot may periodically contact infrastructure controlled by the operator, wait for instructions, or participate in a distributed communication system. The compromise may be difficult for a user to notice because the malicious process can consume only a small proportion of available processing power, memory or network capacity until a command requiring substantial resources is issued.
Command and control is central to botnet operation because the operator needs a mechanism for communicating instructions to compromised devices. A centralised architecture may use one or more command-and-control servers to distribute commands and collect information from bots. This model can be comparatively straightforward to operate but creates infrastructure that defenders can potentially identify, block or seize. More decentralised designs distribute communication among participating systems, reducing dependence on a single server.
Some botnets have used peer-to-peer protocols, domain-generation mechanisms or other techniques intended to make infrastructure more difficult to disrupt. Commands can range from simple instructions to perform a particular network request to complex tasks involving additional malware installation or information collection. Botnets may also receive configuration data describing targets, timing, communication parameters or other operational details. Defenders therefore analyse network traffic, domain registrations, unusual connections, process behaviour and patterns shared across multiple infected systems. Blocking command channels can sometimes neutralise a botnet without removing every individual infection, although previously compromised devices remain security risks until they are cleaned and vulnerabilities are addressed.
One of the most visible uses of botnets is distributed denial-of-service activity, in which many compromised systems simultaneously send traffic or requests towards a target. Because the traffic originates from numerous devices and potentially many networks, distinguishing malicious activity from legitimate distributed traffic can be difficult. Botnets can also distribute spam, conduct automated credential attacks, deliver additional malware, perform web application attacks, manipulate online advertising, commit fraud and support other criminal operations.
Some are rented or sold as services, allowing individuals without the technical ability to build a botnet to purchase access to an existing infrastructure. This creates an underground service economy in which different actors may specialise in malware development, device recruitment, infrastructure, access brokerage or monetisation. Botnets can consequently function as general-purpose criminal infrastructure rather than being tied to a single campaign.
A compromised device can be repurposed for several activities during its lifetime, and operators may change its role remotely. The commercialisation of botnet capabilities has lowered the technical barrier to conducting large-scale malicious activity and has contributed to the persistence of botnet-based threats despite continuing improvements in defensive technology.
Botnet detection involves identifying evidence that a device is being controlled or behaving abnormally. Indicators can include unexpected outbound connections, repeated communication with suspicious infrastructure, unusual DNS activity, unexplained CPU or memory consumption, network traffic that occurs at unusual times, unknown processes, unexpected account changes and repeated connections to large numbers of external systems. Network monitoring can identify coordinated traffic patterns even when individual infected devices appear relatively ordinary. Endpoint security can inspect processes, persistence mechanisms, files and system modifications.
Security teams may also compare activity against known indicators associated with particular botnet families. Detection is complicated by the fact that sophisticated malware may encrypt its communications, alter its behaviour, use legitimate services or remain dormant until instructed. A single symptom is therefore rarely sufficient to establish botnet membership. Investigation generally requires correlating endpoint, network, authentication and threat-intelligence information. When compromise is suspected, containment can include isolating the affected device, blocking malicious communication, terminating unauthorised processes, removing malware, changing compromised credentials and correcting the vulnerability that permitted the initial infection.
Botnets present significant defensive challenges because their distributed nature provides redundancy. Removing one command server may not eliminate the underlying infections, while blocking one network address may have limited effect if thousands of other devices remain active. Botnets can also exploit geographically distributed devices, making jurisdiction, evidence collection and coordinated disruption complicated. At the same time, botnet operations create observable dependencies. The operator needs to recruit devices, communicate with them, distribute instructions and ultimately obtain value from their activity.
Security professionals can therefore attack different stages of the operational chain rather than focusing exclusively on individual malware files. Internet service providers, domain registrars, hosting providers, security researchers and law-enforcement agencies may cooperate to identify and disrupt infrastructure. Sinkholing is one defensive technique in which malicious communications are redirected to infrastructure controlled by defenders, allowing researchers to observe infected systems and sometimes prevent them from receiving criminal commands. Such operations must be carefully designed because botnet infrastructure can contain compromised systems belonging to innocent users.
The most effective protection against botnets combines prevention, detection, containment and recovery. Organisations should maintain supported software, promptly apply security updates, remove unnecessary exposed services, use strong unique administrative credentials, disable default credentials, restrict management interfaces, segment networks and monitor unusual outbound activity. Internet-facing devices should be configured deliberately rather than left with factory settings. Endpoint protection can help detect malicious processes and persistence, while network controls can restrict communications that are not required for legitimate operations.
Backups are important when botnet infections are associated with destructive secondary malware, although backups do not themselves prevent recruitment. For organisations operating connected devices, asset inventories are particularly important because unknown or unmanaged equipment can remain vulnerable for long periods. Users should also be cautious with unexpected downloads, attachments and login requests because many botnet infections begin with ordinary social or technical compromise.
The central security principle is that a botnet is normally the result of many individual security failures being combined into a coordinated system, so reducing exposed vulnerabilities and detecting compromised devices early substantially reduces the ability of an operator to build and maintain that system.
