What Is a Botnet? How Botnet Attacks Work

A botnet is a network of compromised computers, servers, Internet of Things (IoT) devices, or other systems that an attacker can remotely control. Individual compromised devices are often called bots, and large groups of them can be used together to perform coordinated malicious activity.

Botnets can be used to launch distributed denial-of-service (DDoS) attacks, distribute malware, send spam, perform credential attacks, generate fraudulent traffic, and carry out other automated operations at scale.

Understanding what a botnet is, how devices become part of one, how attackers control them, and how defenders identify botnet activity is an important part of network security and threat detection.

What Is a Botnet?

A botnet is a collection of compromised devices that can be controlled remotely to perform coordinated actions. The term combines the words robot and network.

A device can become part of a botnet after being compromised through malware, vulnerable software, weak credentials, exposed services, or other security weaknesses. Once compromised, the device may communicate with infrastructure controlled by an attacker and wait for instructions.

Because a botnet can contain devices distributed across many networks and geographic locations, attackers can use the combined resources of those systems to operate at a scale that would be difficult to achieve from a single machine.

How Does a Botnet Work?

Although botnets vary in design, their operation generally involves compromising devices, establishing a method of communication, and coordinating activity across those devices.

Initial compromise: A device is infected with malware or compromised through a vulnerability, weak credential, or exposed service.
Bot enrollment: The compromised system becomes part of the botnet and establishes communication with attacker-controlled infrastructure or other infected devices.
Command and control: Instructions are distributed to compromised devices through a command-and-control mechanism.
Coordinated activity: Bots perform actions such as generating traffic, scanning networks, sending spam, or attempting additional compromises.
Continued operation: Attackers may attempt to maintain control of the botnet and expand it by compromising additional devices.

What Is a Bot in a Botnet?

A bot is an individual compromised device participating in a botnet. Depending on the botnet, a bot might be a personal computer, server, router, security camera, smart device, or another internet-connected system.

The legitimate owner of the device may not realize that it has been compromised. Malware can operate in the background while the device continues performing its normal functions.

What Is Botnet Command and Control (C2)?

Command and control (C2) refers to the communication mechanisms attackers use to issue instructions to compromised systems and potentially receive information from them.

Some botnets use centralized infrastructure where bots communicate with attacker-controlled servers. Others can use decentralized or peer-to-peer designs that distribute communication across participating systems.

For defenders, identifying suspicious command-and-control communication can be an important indicator that a device has been compromised.

What Are Botnets Used For?

Botnets provide attackers with distributed computing resources and large numbers of network-connected devices. Those resources can be used for several types of malicious activity.

DDoS attacks: Large numbers of bots can generate traffic or requests against the same target.
Spam: Compromised systems can be used to distribute large volumes of unwanted or malicious messages.
Credential attacks: Distributed devices can automate login attempts against online services.
Malware distribution: Botnet infrastructure can help distribute additional malicious software.
Network scanning: Bots can search the internet for additional vulnerable systems.
Fraudulent traffic: Compromised devices can generate automated traffic intended to imitate legitimate activity.

How Are Botnets Used in DDoS Attacks?

Botnets are commonly associated with distributed denial-of-service (DDoS) attacks because they give attackers access to many distributed sources of traffic.

Instead of generating attack traffic from a single system, an attacker can instruct many compromised devices to send traffic or requests toward the same target. The combined activity can consume network bandwidth, connection capacity, application resources, or other infrastructure required by legitimate users.

This distributed behavior is one reason DDoS attacks can be difficult to mitigate. Blocking one source does little when large numbers of other systems continue generating traffic.

DDoS is only one use of a botnet. Other botnets have been built for very different purposes, including large-scale spam campaigns, as demonstrated by the Rustock botnet.

The Rustock Botnet: A Real-World Case Study

Rustock was one of the world's largest spam botnets and provides a useful example of how a large network of compromised computers can be turned into infrastructure for cybercrime. Microsoft's Digital Crimes Unit documented Rustock and led efforts to disrupt the botnet in 2011.

Rustock used rootkit-enabled malware to compromise computers and operate covertly on infected systems. Rather than primarily becoming known for DDoS attacks, the botnet was built around the distribution of enormous volumes of spam email.

At its peak, Microsoft reported that Rustock was responsible for more than 30 billion spam emails per day and accounted for as much as 30–40% of global spam volume. Microsoft also observed that a single infected computer could send thousands of spam messages in less than an hour.

How Rustock Was Taken Down

Rustock also became an important example of how botnets can be disrupted through a combination of technical investigation, legal action, and cooperation between private companies and law enforcement.

In March 2011, Microsoft's Digital Crimes Unit led an operation that used civil court orders to seize servers used by the botnet across multiple hosting facilities. By cutting infected computers off from important command-and-control infrastructure, the operation disrupted the attackers' ability to control the botnet.

The takedown demonstrates an important principle of botnet defense: defenders do not necessarily need to clean every infected computer simultaneously to disrupt a botnet. Identifying and disabling critical infrastructure used to coordinate compromised systems can interfere with the attacker's ability to operate the network.

For a deeper look at the story behind Rustock and other major spam botnets, listen to Darknet Diaries Episode 110: Spam Botnets, which explores Rustock, Waledac, and Cutwail and the people and infrastructure behind them.

How Do Devices Become Part of a Botnet?

Attackers need a way to compromise devices before they can add them to a botnet. The initial access method varies depending on the targeted system and botnet.

Weak or default credentials: Internet-connected devices may expose services protected by easily guessed usernames and passwords.
Unpatched vulnerabilities: Attackers can scan for systems running vulnerable software or firmware.
Malware: Users or systems can be tricked into executing malicious software.
Exposed services: Poorly secured internet-facing services can provide opportunities for compromise.
Automated scanning: Existing bots can continuously search for additional vulnerable devices.

How Can You Detect Botnet Activity?

Botnet detection often involves identifying behavior that differs from a device's expected network activity. Security teams can analyze network telemetry, DNS activity, authentication logs, endpoint data, and other signals for evidence of compromise.

Potential indicators can include:

Unusual outbound connections: A device communicates with unexpected internet hosts or services.
Repeated network connections: Systems repeatedly contact the same external infrastructure.
Unexpected DNS activity: Devices query unusual or suspicious domains.
Abnormal traffic volume: Network activity changes significantly without a legitimate explanation.
Scanning behavior: A system begins attempting connections to large numbers of external addresses or ports.
Endpoint indicators: Security tools identify malicious processes, files, persistence mechanisms, or other evidence of compromise.

No single signal necessarily proves that a system belongs to a botnet. Defenders typically correlate multiple sources of telemetry before determining whether activity represents a compromise.

How Are Botnets Prevented and Disrupted?

Botnet defense involves both preventing devices from becoming compromised and detecting malicious activity when compromise occurs.

Patch vulnerable systems: Keep operating systems, applications, firmware, and internet-connected devices updated.
Replace default credentials: Use strong, unique authentication credentials for devices and services.
Reduce unnecessary exposure: Limit internet-facing services and network access wherever possible.
Monitor network traffic: Identify unusual outbound connections, scanning behavior, and unexpected traffic patterns.
Use endpoint protection: Detect malicious software and suspicious activity on supported systems.
Segment networks: Limit the ability of compromised devices to communicate freely with other systems.

Botnets vs DDoS Attacks: What's the Difference?

A botnet and a DDoS attack are related concepts, but they are not the same thing.

Botnet: A network of compromised devices that can be remotely controlled.
DDoS attack: An attack designed to disrupt the availability of a service using traffic or requests from distributed sources.

A botnet can be used to perform a DDoS attack, but DDoS is only one possible use of a botnet. Likewise, understanding botnets requires looking beyond DDoS to the compromise, command-and-control, and automation mechanisms that allow attackers to coordinate many systems.

Why Botnet Telemetry Matters

Botnet activity can leave evidence across multiple security data sources. DNS logs may reveal suspicious domain lookups, network telemetry can reveal unexpected connections, endpoint systems can identify malware, and authentication logs can reveal automated access attempts.

For security operations teams, the challenge is often connecting these individual signals into a larger picture. A single unusual connection may not be meaningful, but repeated communication patterns combined with suspicious DNS activity and endpoint indicators can provide stronger evidence of compromise.

This makes botnet detection a useful example of why correlation and contextual analysis are important in modern security operations.

Why Cybersecurity Learners Should Understand Botnets

Botnets connect several important cybersecurity concepts, including malware, networking, command and control, IoT security, DDoS attacks, threat intelligence, network monitoring, and incident response.

For defenders, understanding a botnet is not simply about memorizing a definition. It means understanding how devices become compromised, how malicious infrastructure communicates, what evidence appears in security telemetry, and how defenders can identify and contain compromised systems.

These concepts are particularly relevant for security operations analysts, network defenders, cloud security professionals, incident responders, and other practitioners responsible for detecting malicious network activity.

Explore HuntCode

HuntCode is building hands-on cybersecurity learning experiences around practical defensive skills, AI-powered guidance, and real security workflows. Learners can develop an understanding of network security, security telemetry, threat detection, incident response, and other concepts used in modern defensive environments.

Learners: Explore HuntCode to develop practical cybersecurity skills through lessons, labs, and AI-powered learning experiences.
More from HuntCode: Follow our blog for articles on network security, web application security, AI in cybersecurity, threat intelligence, and hands-on cyber defense.

A botnet turns many individual compromised devices into coordinated infrastructure that an attacker can control at scale.