A botnet (robot network) is a network of compromised computers, servers, IoT devices, and other internet-connected devices (bots or zombies) controlled remotely by an attacker (botmaster or bot herder). Each bot is infected with malware that allows the botmaster to issue commands via Command & Control (C2 or C&C) servers. Botnets are used to perform large-scale cyberattacks, including Distributed Denial-of-Service (DDoS), spam distribution, credential stuffing, cryptocurrency mining, click fraud, and data theft. Botnets represent one of the most significant cyber threats, with millions of devices compromised globally.
Global Impact: Over 1.5 billion devices are part of botnets globally (2024). Botnets generate $10+ billion annually for cybercriminals through DDoS-for-hire, spam campaigns, ransomware distribution, and credential theft. The Mirai botnet (2016) infected 600,000+ IoT devices and launched record DDoS attacks (1.2 Tbps).
Common targets of botnet operations:
Attacker infects devices with bot malware via phishing emails, exploit kits, drive-by downloads, default credentials (IoT), or software vulnerabilities.
Infected bot connects to Command & Control (C2) server for instructions (beaconing every 30-60 seconds).
Botmaster issues commands (attack target, duration, method) via C2 server using IRC, HTTP, or P2P protocols.
Bots execute malicious activities (DDoS flood, spam sending, credential stuffing, cryptojacking, data exfiltration).
// Botnet architecture - Command & Control (C2) models
// 1. Centralized C2 (IRC, HTTP) - Single point of failure
Bot → [IRC Server] ← Botmaster
Bot → [HTTP C2] ← Botmaster
// 2. Peer-to-Peer (P2P) - Decentralized, resilient
Bot ↔ Bot ↔ Bot (no central server)
Botmaster communicates via P2P network
// 3. Hybrid (P2P + backup C2) - Most resilient
// Mirai botnet infection and C2 communication
// Step 1: Scan for IoT devices with default credentials (telnet/SSH)
// Step 2: Infect device, download malware (wget/curl)
// Step 3: Bot reports to C2 server (report IP, arch, loader)
// Step 4: C2 issues attack commands (UDP flood, SYN flood, HTTP flood)
// Example botnet C2 command (Mirai)
ATTACK 203.0.113.1 udp 900 1000000 # UDP flood, port 900, 1M pps
// Emotet botnet (spam distribution)
// Bot downloads spam module from C2
// Bot sends spam emails using stolen templates
// Bot harvests email addresses from infected Outlook
// TrickBot botnet (banking trojan + credential theft)
// C2 injects web injection modules (banking credential theft)
// Bot steals saved passwords (browsers, email, FTP)
Bots connect to central C2 server (IRC, HTTP/HTTPS, DNS). Simple architecture, low latency. Single point of failure - law enforcement can seize C2 server. Examples: Zeus (HTTP), Mirai (Telnet/HTTP), Emotet (HTTP).
Decentralized architecture - bots communicate directly with each other (no central server). More resilient to takedown. Uses DHT (Distributed Hash Table) or custom protocols. Examples: Storm Worm (P2P), GameOver Zeus (P2P), Sality.
Primary P2P network with backup centralized C2 servers. Most resilient architecture. If P2P disrupted, bots fallback to centralized C2. Used by advanced botnets (Emotet, TrickBot).
Bots encode commands/data in DNS queries to malicious DNS servers. Evades firewall restrictions (UDP port 53 often open). Used by malware that can't use HTTP/HTTPS.
Mirai botnet (2016) infected 600,000+ IoT devices (routers, IP cameras, DVRs) by scanning for default Telnet/SSH credentials. Launched record DDoS attacks: Krebs on Security (620 Gbps), OVH (1.1 Tbps), Dyn DNS (1.2 Tbps). Source code leaked - spawned hundreds of variants (Satori, Masuta, Okiru, JenX).
Zeus variant (2011-2014) using peer-to-peer (P2P) C2 for resilience. Banking trojan that stole millions in financial credentials. Used web injection, form grabbing, man-in-the-browser. Disrupted by Operation Tovar (2014) - FBI/Europol.
Emotet (2014-2021, resurged 2022) evolved from banking trojan to malware loader as-a-service. Distributed ransomware (Ryuk, Conti), TrickBot, QakBot. Used spam email with malicious attachments. Dismantled by international law enforcement (2021).
Necurs (2012-2020) controlled 6-9 million infected systems. Responsible for 80% of global spam at peak. Distributed Dridex banking trojan, Locky ransomware. Used rootkit for persistence. Disrupted by law enforcement (2020).
Conficker worm (2008) infected 10+ million systems. Created one of largest botnets in history. Used multiple propagation methods: SMB exploit (MS08-067), USB autorun, weak password brute force. Still active with 500,000+ infections.
Storm Worm (2007) pioneered P2P botnet architecture. Infected 1-10 million systems. Used for spam distribution (stock pump-and-dump) and DDoS attacks. One of first botnets using custom P2P protocol.
TrickBot (2016-2022) modular banking trojan with worm module (lateral movement). Used for credential theft, ransomware delivery (Conti). Evolved into botnet module for DDoS attacks. Disrupted by law enforcement (2022).
Mozi botnet (2019-2023) targeted IoT devices (routers, DVRs) using P2P architecture. Used for DDoS attacks, data theft, proxy services. Infected 1.5 million devices globally. Disrupted by Chinese law enforcement (2023).
IoT botnet malware targeting devices with default Telnet/SSH credentials (Routers, IP cameras, DVRs). Source code leaked (2016). Features: scanner (IP scanner), loader, C2 server (Telnet, HTTP), attack modules (UDP flood, SYN flood, HTTP flood, GRE flood).
Botnet malware with web injection (banking credential theft), keylogging, lateral movement (SMB, RDP, PsExec), and DDoS capabilities. Modular architecture with plugin system.
Modular botnet malware (loader-as-a-service) that downloads additional payloads (TrickBot, Ryuk, Conti). Uses spam email distribution, automated harvesting of email templates, and worm-like propagation.
Remote Administration Tool (RAT) with botnet capabilities. Features: remote control, keylogging, screen capture, file management, DDoS attacks, and botnet management (list of infected bots).
Banking trojan botnet toolkit (source code leaked 2011). Features: web injection (man-in-the-browser), form grabbing, credential theft, P2P C2 (GameOver Zeus), and encrypted configuration files.
This demonstration simulates a botnet launching a DDoS attack against a target server:
This is a simulated demonstration. Real botnets can include millions of infected devices (IoT, computers, servers) performing DDoS attacks (500+ Gbps), spam distribution (billions of emails), credential stuffing, and cryptojacking. Protect your devices by changing default passwords, keeping software updated, using EDR/antivirus, and monitoring network traffic.
High outbound traffic volume, connections to suspicious IP addresses/domains (C2 servers), beaconing patterns (regular check-in every 30-60 seconds), DNS queries to algorithmically generated domains (DGA - Domain Generation Algorithm). Detected via NetFlow, NIDS (Snort/Suricata).
Spike in CPU utilization (cryptocurrency mining), excessive outbound bandwidth (DDoS attack, spam distribution), high memory usage, and unusual process activity (unfamiliar executables).
Detect known botnet C2 communication patterns (IRC, HTTP, DNS tunneling), DDoS attack traffic (SYN flood, UDP flood, ICMP flood), and botnet-specific signatures (Mirai, Emotet, TrickBot, Zeus).
Authoritative DNS sinkholes redirect malicious botnet C2 domains to controlled infrastructure. DNS query logs show infected devices attempting to connect to known C2 domains (sinkhole IP).
// Botnet detection commands and indicators
# Detect outbound connections to known C2 IPs (Mirai C2 ports 23, 48101)
sudo netstat -anp | grep -E ":23|:48101|:443"
# Detect DDoS attack traffic (high packet rates)
sudo tcpdump -i eth0 -n -c 1000 | grep -E "SYN|UDP"
# Detect DNS queries to DGA domains (random-looking subdomains)
sudo tcpdump -i eth0 -n port 53 | grep -E "[a-z0-9]{16}\.com"
# Snort rule for Mirai botnet C2 detection
alert tcp $HOME_NET any -> $EXTERNAL_NET 48101 (
msg:"ET TROJAN Mirai Botnet C2 Checkin";
content:"|00 00 00 00 00 00|"; depth:6;
sid:2024150; rev:1;
)
# Windows - detect scheduled tasks (botnet persistence)
schtasks /query /fo LIST /v | findstr "TaskName\|Task To Run"
# Linux - detect cron jobs (cryptominer botnet)
crontab -l
cat /etc/crontab
# Monitor for high CPU usage (cryptojacking botnet)
top -b -n 1 | head -20
Mirai and other IoT botnets exploit default usernames/passwords (admin/admin, root/root, admin/12345). Change default credentials immediately. Disable Telnet (port 23) and SSH (port 22) if not needed.
Botnets exploit unpatched vulnerabilities (EternalBlue, MS08-067, default Telnet credentials). Apply security patches immediately (critical within 48 hours). Enable automatic updates for OS, IoT firmware, routers.
Deploy NIDS (Snort, Suricata) with botnet C2 signatures. Monitor outbound connections to suspicious IPs/domains. Use NetFlow/sFlow for traffic analysis. Implement DNS sinkhole for known botnet domains.
Deploy EDR (CrowdStrike, Microsoft Defender for Endpoint, SentinelOne) with botnet detection capabilities. Enable Windows Defender with cloud-delivered protection. Run regular scans.
Segment IoT devices into separate VLANs (no access to production networks). Prevent botnet lateral movement. Use microsegmentation (Zero Trust). Block outbound traffic from IoT devices except necessary.
Best Practice - Preventing Botnet Infections: Change default credentials on all IoT devices (routers, cameras, DVRs) - Mirai exploits default passwords. Keep firmware and software updated (patch vulnerabilities). Deploy EDR/antivirus with botnet detection. Monitor network traffic for C2 communication (beaconing patterns, DGA domains). Segment IoT devices into isolated VLANs (prevent lateral movement). Block outbound connections to known botnet C2 IPs/domains (threat intelligence feeds).
Botnet operation (recruiting bots, operating C2 servers, launching DDoS attacks) is illegal in all jurisdictions with severe criminal and civil penalties:
Botnet operation (recruiting bots, operating C2 servers, launching DDoS attacks, distributing spam, credential stuffing) is illegal in all jurisdictions and carries severe criminal and civil penalties:
Critical Notice: This guide is provided for educational and defensive purposes to help security professionals, network administrators, and defenders understand botnet threats for legitimate activities: protecting networks from botnet infections, implementing detection capabilities (NIDS, EDR, DNS sinkholes), and conducting authorized penetration testing (with written permission).
Operating botnets (recruiting bots, C2 servers, DDoS attacks) is criminal activity with severe consequences: federal felony charges (CFAA, RICO), lengthy imprisonment (10-20 years for major botnet operators), asset forfeiture, permanent criminal record, civil liability (victims can sue for billions), and professional sanctions. Law enforcement agencies (FBI, Secret Service, Europol, INTERPOL) actively investigate and prosecute botnet operations (Operation Tovar, Operation Endgame, Operation Power Off, Operation GhostClick).
If your device is part of a botnet: Run antivirus/EDR scan, change default credentials (IoT), update firmware, block outbound connections to C2 IPs, monitor network traffic, report to ISP. Organizations: Deploy network monitoring (NIDS), DNS sinkhole, block known botnet C2 domains, segment IoT devices, report botnet activity to CISA (cisa.gov/report) and FBI IC3 (ic3.gov).
CISA (Cybersecurity and Infrastructure Security Agency) botnet guidance: detection (NetFlow, DNS sinkhole), mitigation (block C2 domains), and incident response.
Shadowserver Foundation provides free botnet scanning reports (Mirai, Emotet, TrickBot, Mozi) for network owners. Daily reports on infected devices in your IP space.
MITRE ATT&CK framework tactics: T1095 (C2 - IRC, HTTP), T1071 (Application Layer Protocol), T1059 (Command and Scripting Interpreter), T1043 (Commonly Used Port).
Course covering botnet C2 communication analysis (IRC, HTTP, DNS, P2P), botnet detection (network forensics), and botnet takedown methodology.
Community-maintained YARA detection rules for botnet malware (Mirai, Emotet, TrickBot, QakBot, Zeus). Essential for threat hunting and detection development.