What is a botnet?
A botnet is a group of compromised computers and devices that an attacker controls remotely as a single resource. Each infected device is a bot, sometimes called a zombie, and the person or group running the botnet is often called the bot herder. The bots receive instructions through command and control (C2) infrastructure and carry them out together, which turns thousands or millions of ordinary devices into one large tool. Owners usually have no idea their device is involved.
How botnets are built and controlled
Botnets grow by infecting devices at scale: through worms that spread on their own, phishing and trojans on PCs, and automated scanning for internet-facing devices with default or weak passwords and unpatched firmware. Routers, IP cameras, DVRs and other IoT devices are frequent recruits, because they are always on, rarely patched and seldom monitored.
Control comes in two main designs. In a centralized botnet, bots check in with C2 servers or domains, which is simpler for the herder but gives defenders a target to take down. In a peer-to-peer botnet, bots pass commands among themselves, so there is no single server to remove.
What botnets are used for
- Distributed denial-of-service (DDoS) attacks that flood a target with traffic from many sources
- Sending spam and phishing email
- Credential stuffing and password spraying spread across thousands of IP addresses to avoid lockouts and rate limits
- Cryptocurrency mining on victims' hardware
- Click fraud and ad fraud
- Proxy services that route criminals' traffic through victims' internet connections
Many botnets are rented out, so an attacker with little skill can buy attack traffic by the hour.
A real example: Mirai
In 2016, the Mirai botnet infected large numbers of IoT devices, mainly cameras and DVRs, by logging in over Telnet with a short list of factory default usernames and passwords. In October 2016 its traffic overwhelmed the DNS provider Dyn, making many major websites unreachable for hours. Mirai showed how unmanaged devices with default credentials become an attack resource for someone else.
How to defend against botnets
To keep your own devices out of a botnet: change default credentials, patch firmware, disable unused services such as Telnet, place IoT devices on segmented networks, filter outbound traffic and watch for beaconing to unknown hosts. To withstand an attack from a botnet: use DDoS mitigation from an ISP or a specialist provider, rate limiting and web application firewalls, and MFA plus bot detection to blunt credential stuffing. Law enforcement and researchers dismantle botnets by seizing or sinkholing their C2 infrastructure.
Botnet on the CompTIA Security+ exam
Botnets fall under SY0-801 objective 2.5, both as malware and as the source behind DDoS and credential attacks. Scenario wording that points to one describes many compromised devices acting together under remote control, attack traffic from thousands of sources, IoT devices with default passwords, or an internal host beaconing to C2 and taking part in an attack on someone else. Distractors include worm (the spreading mechanism, not the controlled network), DDoS (the attack, not the infrastructure), RAT and command and control itself.