Botnet Definition

What is a Botnet?

A botnet is a collection of systems that work together to perform distributed, automated attacks. Some common examples of attacks performed by botnets include credential stuffing, scanning, and distributed denial of service (DDoS) attacks.

How is a Botnet Created?

A botnet is simply a collection of computers that a cybercriminal can control and use in their attacks. It’s entirely possible for a botnet to be composed of cloud-based infrastructure or computers owned and controlled by the attacker.

However, it’s much more common for an attacker to build a botnet using malware. This makes it possible to build a much larger army of “zombies” — the systems in a botnet — and ensures that the botnet’s operations cost the attacker nothing and are more difficult to trace back to them.

Often, botnets are built by distributing malware that exploits vulnerabilities in insecure, Internet-connected systems such as Internet of Things (IoT) devices or routers. Once the malware is installed on a vulnerable system, it listens for and follows instructions from a command-and-control (C2) server. This design enables the botnet operator to coordinate a large number of systems from only one or a few C2 servers.

Common Uses for Botnets

The main virtue of a botnet is that it is composed of a large number of systems with processing power and Internet connectivity. These factors make botnets ideally suited to large-scale, automated attacks.

Botnets can be used for various malicious purposes. Some of the most common botnet-driven attacks include:

• DDoS Attacks: In a DDoS attack, multiple attackers spam a target with more traffic or requests than it is able to handle, rendering it unable to less able to respond to legitimate users’ requests. Botnets are often used for DDoS attacks because they can make the attack larger, more distributed, and more difficult to defend against due to the number of unique systems and IP addresses involved.
• Credential Stuffing: In a credential stuffing attack, the attacker takes common passwords and ones used in a breach and tries to use them to log into accounts on different services. Botnets can perform credential stuffing attacks very quickly, and the distribution of the attackers makes rate limiting or blocking known-bad IP addresses less effective.
• Malware Distribution: Botnets are created by identifying vulnerable systems and infecting them with malware. A botnet can be used to distribute malware to grow the botnet or install other types of malware — such as ransomware or infostealers — on vulnerable systems.
• Spamming: Botnets can also be used to distribute spam or phishing emails. These emails can contain malicious links or attachments used to distribute malware or steal sensitive information.
• Cryptojacking: Cryptojacking malware uses an infected computer’s processing power to mine cryptocurrency. A botnet operator can use its zombies to mine cryptocurrency and make money for themselves.

Protecting Against Botnet Attacks

Botnets pose a two-fold threat. On the one hand, an organization’s systems may be infected and used in attacks. On the other, they make be the target of a DDoS or other attack performed by a botnet.

An organization can protect against botnet malware infections by implementing endpoint security best practices. For example, using strong passwords, installing an antivirus, and promptly installing updates to devices — including IoT devices — can dramatically reduce the risk of infection.

On the other side of the equation, the best way to protect against botnets is to address the potential threats that they pose. For example, an organization may wish to implement anti-DDoS solutions and multi-factor authentication (MFA) to reduce the risk of DDoS and credential stuffing attacks.

Conclusion

Botnets are networks of systems infected with botnet malware that are used by cybercriminals in automated attacks. Some of the most common threats that botnets pose include DDoS and credential stuffing attacks. The best way to manage these threats is to implement endpoint security best practices and deploy defenses against common automated attacks.