Learning centre

Attacks & threats

7 min readUpdated

What is a botnet?

Quick answer

A botnet is a collection of internet-connected devices that have been compromised and can be commanded remotely by whoever controls them. The owners of those devices are usually unaware — the machine keeps working normally while quietly taking orders. Botnets are rented out and used for distributed denial-of-service attacks, credential stuffing, scraping, click fraud and spam. Their defining property for a defender is distribution: instructions come from one place, but traffic arrives from thousands of unrelated addresses at once.

How a botnet is assembled

Most botnets are not built by breaking into anything sophisticated. They are assembled by scanning the internet for devices with known vulnerabilities or default credentials and installing a small program that phones home for instructions.

Consumer routers, IP cameras, DVRs and other embedded devices are the classic recruits: permanently online, rarely updated, often shipped with a default password, and almost never monitored by their owners. A compromised camera can spend years in a botnet without anyone noticing.

  • Scanning for default or reused credentials on exposed management ports
  • Exploiting unpatched vulnerabilities in embedded firmware
  • Malicious downloads and email attachments on desktop machines
  • Compromised or abandoned cloud instances, which have far better bandwidth

How they are controlled

Every bot needs to receive instructions, and the mechanism it uses is the botnet's biggest weakness. Older designs had every bot connect to a single command-and-control server, which meant seizing that one server ended the whole network.

Modern botnets are more resilient. They use algorithmically generated domain names so there is no fixed address to seize, peer-to-peer designs with no central server at all, or ordinary services — chat platforms, code hosting, social media — as a hiding place for commands.

DesignHow it worksHow it is taken down
Central C2All bots connect to one serverSeize the server; whole network dies
Domain generationBots compute new domains dailyRegister the domains before the operator does
Peer-to-peerBots relay commands to each otherVery hard — no single point to remove
Third-party servicesCommands hidden in normal platformsRequires the platform's cooperation

What they are used for

DDoS is the most visible use but far from the only one. A botnet is really just a large pool of internet connections that someone else is paying for, which makes it useful for anything that benefits from looking like many different people.

  • DDoS attacks — sold openly as "stresser" or "booter" services
  • Credential stuffing, where each attempt appears to come from a different address
  • Scraping at scale, spread thin enough to defeat per-address rate limits
  • Click and impression fraud against advertising networks
  • Spam relaying and phishing distribution
  • Residential proxy networks, sometimes sold as a legitimate product

Why they are hard to defend against

A botnet's advantage is that every individual request looks ordinary. One connection from a home broadband address requesting your homepage is exactly what a customer looks like. Only the aggregate reveals the pattern.

This is why rate limiting per address does so little: each bot only needs to send a handful of requests. Ten thousand bots making two requests a second each will pass any sane per-client limit while delivering twenty thousand requests a second to your origin.

  • Look for one signature repeated across many unrelated addresses
  • Compare against your own baseline, not a fixed threshold
  • Use challenges — a bot on an embedded device usually cannot run JavaScript
  • Corroborate before acting, so one unusual visitor is never treated as an attack

Keeping your own devices out of one

  • Change default credentials on anything with a management interface
  • Do not expose router, camera or NAS admin ports to the internet
  • Keep firmware updated, and retire devices the vendor no longer patches
  • Watch for outbound connections from devices that should have no reason to make them

Frequently asked questions

Last updated