A botnet is a group of hijacked internet-connected devices that an attacker controls remotely and uses to carry out large scale attacks. CISA describes it this way, and NIST notes that the word comes from "robot" and "network". Each infected device is called a bot.
- Also Called3other namesbot network · zombie network · bots
- Related Terms3linked entriesDDoS attack · Command and control (C2) · Malware-as-a-service (MaaS)
What is a botnet?
CISA describes a botnet as a group of hijacked internet-connected devices used to carry out large scale attacks. NIST explains that the word is formed from “robot” and “network”. Criminals take control of many computers and organize the infected machines into a network of bots that the criminal can manage remotely.
How does a botnet work?
CISA says attackers take advantage of security vulnerabilities or device weaknesses to control numerous devices. They manage those devices with command and control software. Command and control means the channel an attacker uses to send instructions to infected machines.
NIST says criminals often use special Trojan programs to break into the computers. A Trojan is malicious software that pretends to be something harmless.
CISA also says botnets may be rented out to other attackers through attack-for-hire services. These services allow unskilled users to launch DDoS attacks. A DDoS attack is an attack where many machines flood one target so that real users cannot reach it.
- Weak devices are foundAttackers use security vulnerabilities or device weaknesses such as default passwords.
- Devices are taken overInfection of IoT devices often goes unnoticed by their owners.
- Bots take ordersThe attacker manages the devices with command and control software.
- The botnet is used or rented outLarge scale attacks, including DDoS, can be launched even by unskilled users.
Which devices end up in botnets?
CISA says Internet of Things (IoT) devices are vulnerable because they often use default passwords and do not have sound security postures. IoT devices are everyday connected objects such as cameras and routers. CISA adds that infection of IoT devices often goes unnoticed by users. In general terms, this means an owner may not know that a device has become part of a botnet.
Why does it matter?
A botnet gives one attacker the combined power of many devices. CISA says this power is used for large scale attacks, and that rented botnets let unskilled users launch DDoS attacks. Because infections often go unnoticed, an organization may not realize that its own devices are helping to attack someone else. Defenders therefore care about both being attacked by a botnet and having devices inside one.
How can you reduce the risk?
CISA recommends strengthening the security of internet-connected devices. Its advice includes the following.
- Install and maintain antivirus software.
- Install and configure a firewall.
- Evaluate the security settings of your devices and follow good security practices.
Since default passwords are a known weakness, checking the settings of any connected device is a sensible first step.
Is a botnet the same as a DDoS attack?
No. A botnet is the group of compromised devices. A DDoS attack is one thing a botnet can be used for. CISA mentions DDoS attacks when it describes rented botnets, so the two are closely linked, but they are different ideas.
Is a bot the same as a botnet?
No. A bot is a single infected device. A botnet is the whole network of bots under one controller.
Related pages in the Knowledge Hub
Sources
- NIST: Botnet is formed from robot and network; criminals use Trojans to take control of computers and organize them into a network of bots they manage remotely.
- CISA: Botnet is a group of hijacked internet-connected devices; control via vulnerabilities and command and control software; IoT default passwords; rental through….
Also Called.
- Namebot network
- Namezombie network
- Namebots
Questions.
-
What is a botnet?
CISA describes a botnet as a group of hijacked internet-connected devices used to carry out large scale attacks. Criminals organize the infected machines into a network of bots that they manage remotely.
-
How does a botnet work?
CISA says attackers take advantage of security vulnerabilities or device weaknesses to control numerous devices. They manage those devices with command and control software, which is the channel used to send instructions.
-
Why are IoT devices used in botnets?
CISA says Internet of Things devices are vulnerable because they often use default passwords and lack sound security. Infection of these devices often goes unnoticed by their owners.
-
How can you reduce the risk of botnets?
CISA recommends strengthening the security of internet-connected devices: install and maintain antivirus software, configure a firewall, and evaluate device security settings. Checking default passwords is a sensible first step.
In Our Research
- 1 Bots Gone Bad: The Untold Story of Botnet Invasions February 2025
- 2 Utilizing Botnet Databases to Mitigate Cyber Risks August 2024
- 3 ZeroBot: New Botnet Malware Using IoT Security Vulnerabilities December 2022
- 4 Mirai Variant MooBot Botnet Targets Vulnerable D-Link Devices September 2022
- 5 Beastmode Botnet Targets Security Vulnerabilities in Totolink Routers April 2022
- 6 Cyclops Blink Botnet Targets ASUS Routers and WatchGuard Devices March 2022