A botnet is a network of compromised computers, servers or connected devices that an attacker controls remotely through a command-and-control channel, using their combined bandwidth, processing power and network addresses for malicious work. Each infected machine is a bot, and the person or group running the network is often called the bot herder or botmaster.
Within malware and attacks in cybersecurity, a botnet is less a single piece of malware than an infrastructure: the infected hosts, the control servers and the tasks they carry out. That infrastructure powers distributed denial-of-service attacks, spam, credential stuffing, ad fraud and malware delivery, and it is often rented out to other criminals as a service.
How a botnet is built and controlled
A botnet grows through infection at scale. Bot malware spreads through phishing attachments, exploit kits, trojanized software, worms that scan for vulnerable services and, for IoT devices, default or weak passwords on Telnet and SSH. Once installed, the bot hides, gains persistence and checks in with its controller to wait for instructions.
| Stage | What happens | Defender opportunity |
|---|---|---|
| Infection | Malware reaches the device | Patching, email filtering, strong passwords |
| Enrollment | Bot contacts the control server | Blocking known C2 domains and addresses |
| Command | Operator sends tasks to bots | Detecting periodic beaconing traffic |
| Monetization | Attacks, fraud or resale of access | Rate limiting and abuse detection |
| Maintenance | Updates, new modules, re-infection | Sinkholing and coordinated takedowns |
Bots usually poll for commands at regular intervals, a behavior called beaconing, rather than keeping a constant connection. Polling over HTTPS or DNS blends into ordinary traffic and survives firewalls that block inbound connections.
Command-and-control architectures
The command-and-control (C2) design determines how hard a botnet is to dismantle. Early botnets used one central server, which made them easy to cut off; modern ones add redundancy, peer-to-peer relays and generated domain names so that defenders cannot disable them with a single action.
| Model | How bots receive commands | Resilience | Weak point |
|---|---|---|---|
| Centralized IRC or HTTP | Connect to one or a few servers | Low | Server seizure ends control |
| Peer-to-peer | Commands spread between bots | High | Protocol analysis enables poisoning |
| Domain generation algorithm | Bots compute daily domain lists | High | Reverse engineering predicts domains |
| Fast flux | Domains rotate through many bot IPs | Medium to high | Registrar and DNS cooperation |
| Legitimate service abuse | Commands hidden in cloud or social platforms | Medium | Platform account suspension |
Commands are usually signed or encrypted so that researchers cannot take over the network by sending their own instructions. This is why takedowns typically target the domains and servers rather than the bots themselves.
What botnets are used for
A botnet is valuable because it provides many distributed IP addresses and resources that are not traceable to the operator. The same network can switch between tasks, and operators often sell or rent capacity.
| Use | Why a botnet helps | Who pays the price |
|---|---|---|
| DDoS attacks | Combined bandwidth overwhelms a target | Online services and their providers |
| Credential stuffing | Login attempts spread across many addresses | Account holders and login services |
| Spam and phishing | Mail sent from many residential addresses | Email recipients |
| Malware loading | Bots install ransomware or other payloads | Organizations hit by ransomware |
| Residential proxies | Criminal traffic appears to come from homes | Sites misled about traffic origin |
| Ad and click fraud | Fake views and clicks look human | Advertisers |
| Cryptomining | Victims pay for the electricity | Device owners |
Loader botnets deserve special attention. Families such as Emotet started as banking malware and later became delivery platforms, selling access to infected networks that ransomware groups then exploited.
Botnets compared with related malware
A botnet overlaps with several neighboring categories, and the difference lies in purpose and scale. A trojan or worm is a delivery method; a rootkit is a hiding technique; a botnet is the collective, remotely commanded result. One infection can combine all of them: a trojan installs a bot, a rootkit hides it, and the bot joins a botnet.
The IoT botnet is a distinct subclass. Routers, cameras and video recorders rarely receive updates, often ship with shared default passwords and stay online permanently. The Mirai botnet showed the impact in October 2016, when attacks from infected IoT devices against a major DNS provider disrupted access to many large websites for hours.
Detecting and disrupting botnets
Inside an organization, the goal is to find infected hosts before they are monetized. The strongest signals are behavioral, because bot binaries change constantly while their network habits do not.
- Regular, small outbound connections to rare domains at fixed intervals indicate beaconing.
- Many failed DNS lookups for random-looking names suggest a domain generation algorithm.
- Unexpected outbound traffic on SMTP, IRC or high ports from workstations or servers is suspicious.
- Devices sending traffic at unusual volumes, especially cameras or printers, point to an IoT bot.
- Threat intelligence feeds of known C2 addresses enable blocking at DNS resolvers and firewalls.
At the internet level, botnets are disrupted through sinkholing, where researchers or authorities redirect C2 domains to servers they control, and through coordinated law enforcement takedowns of infrastructure, such as the international action against Emotet in January 2021. Takedowns often succeed only temporarily, because operators rebuild from surviving infections unless the bots are cleaned.
A plain-language summary
A botnet is like a secret army of hijacked computers. A criminal sneaks a small program onto thousands of laptops, routers or cameras. Their owners usually notice nothing, but each device quietly waits for orders.
When the criminal gives a signal, all of them act at once: flooding a website until it collapses, sending spam or trying stolen passwords. The danger comes from numbers, not from any single device, which is why securing even a cheap home camera helps everyone.
An example from practice
An online retailer sees its login page slow down every evening. Logs show hundreds of thousands of login attempts from tens of thousands of residential IP addresses, each address trying only a few accounts. The pattern points to a botnet running credential stuffing with leaked password lists.
The security team adds bot detection at the edge, enforces multi-factor authentication for accounts with stored payment cards and rate-limits logins by account rather than by address. Within two weeks, account takeovers fall sharply and the attack traffic moves elsewhere. The team also reports the most active networks to their providers, several of which identify infected home routers as the source.