What Is a Botnet?
A botnet is a network of compromised devices — PCs, servers, routers, IoT gadgets — that an attacker controls remotely as a single force. Each infected machine (a “bot” or “zombie”) quietly awaits orders from the attacker’s command-and-control infrastructure. The power of a botnet is scale: thousands of devices acting in unison do what one never could.
How is a botnet built and controlled?#
Two components define it: the bots and the command-and-control (C2) channel.
Devices are recruited by malware — often a worm exploiting an unpatched vulnerability, or a trojan the user runs. Once infected, each bot phones home to the C2 channel and waits. The attacker (the “bot herder”) issues one command and the whole network acts. C2 has evolved from central IRC servers to resilient peer-to-peer and domain-generation designs specifically to survive takedown attempts.
What are botnets used for?#
Anything that benefits from massive distributed scale:
| Use | Why scale helps |
|---|---|
| DDoS attacks | Combined bandwidth overwhelms a target |
| Spam / phishing | Millions of messages from diverse IPs |
| Credential stuffing | Parallel login attempts dodge rate limits |
| Cryptomining | Free compute across thousands of machines |
| Proxy networks | Hide the true origin of other attacks |
The DDoS case is the classic one — a botnet is what turns a nuisance into an outage.
How are botnets taken down?#
By attacking the C2 channel. If defenders and law enforcement can seize the control servers or sinkhole the domains the bots call, the network goes deaf and dark. This is why egress filtering and DNS monitoring matter — spotting a device reaching out to known C2 is often the first sign of infection.
Botnets connect malware to network attacks. More at the Security Fundamentals hub.
Frequently asked questions#
What is a botnet used for?
Botnets monetize scale. Common uses include distributed denial-of-service (DDoS) attacks, sending spam and phishing at volume, credential stuffing, click fraud, cryptomining, and acting as proxies to hide other attacks. The value is the combined bandwidth, compute, and IP diversity of thousands of hijacked devices.
What is command and control (C2)?
Command and control is the channel an attacker uses to send instructions to the compromised devices in a botnet. It may run over IRC, HTTP, DNS, or peer-to-peer protocols. Disrupting C2 — by blocking or seizing the servers — is a primary way defenders and law enforcement dismantle botnets.