Botnet
Also known as: botnets, zombie network, bot network, zombie army
A botnet is a network of computers, phones, routers, cameras, and other internet-connected devices that have been infected with malware and are secretly controlled by an attacker, called a bot herder.
The owners usually have no idea. Botnets are rented out to send spam, launch DDoS attacks, steal credentials, mine cryptocurrency, or hide criminal traffic. While police have taken down major botnets, cheap, poorly secured smart devices keep supplying new recruits.
Botnet, explained at three levels
At home
A botnet is like a crowd of sleepwalkers all taking orders from one person. Malware sneaks onto computers, routers, and cameras, often through default passwords, and each infected device quietly checks in with the criminal's server. When the order comes, thousands of them act at once, sending spam or flooding a website, while their owners have no idea anything is happening.
At work
A botnet is a network of infected devices, such as computers, routers, and cameras, that a criminal controls remotely. Attackers rent botnets out to send spam, try stolen passwords at scale, or flood websites with traffic. For a business, botnets are both a threat from outside and a risk inside, since unpatched company devices can be recruited and used against others.
At home
A botnet turns many infected devices into one tool. Malware gets onto routers, cameras, smart TVs and computers, often through default passwords or old flaws that were never patched. Each infected device quietly checks in with the attacker's server for instructions. On command, thousands of them act together: flooding a website with traffic, sending spam, or relaying criminals' internet traffic so it looks like it comes from your home. Most owners never notice anything wrong.
At work
Botnets are controlled through a command-and-control channel. Simple ones use a central server, which makes them easier to take down, while resilient ones use peer-to-peer networks or domain generation algorithms that create new domains daily. Mirai, which spread through default passwords on cameras and routers in 2016, launched record denial-of-service attacks. Modern botnets are often rented as residential proxy services, letting criminals route attacks through innocent home connections to dodge IP blocking.
At home
Many smart devices never get security updates and ship with weak default passwords, which makes them easy recruits. Investigations have found some cheap Android TV boxes sold with malware already installed, such as the BadBox operation. While you may not notice your device is part of a botnet, your internet slows, and your address may get blocked by websites. In my view, buying from brands that publish updates, and changing default passwords, is worth the extra cost.
At work
Defenders disrupt botnets at the control channel: DNS filtering and sinkholing of known command domains, outbound traffic monitoring for beaconing patterns, and blocking egress from IoT segments to anywhere but required services. Edge devices such as VPN gateways and routers are prime recruits for state-linked botnets, as Volt Typhoon's KV-botnet showed, so replace end-of-life hardware. Law enforcement takedowns, often coordinated with ISPs, seize infrastructure but rarely clean infected devices, so reinfection is common without patching.
Real-world examples
At home
Carlos noticed his home internet was oddly slow at night. His ISP contacted him to say his old security camera was part of a botnet, and replacing it fixed the problem.
At work
Fatima manages IT for a Saskatoon property company. DNS filtering flagged several building cameras contacting a known botnet server, so she isolated them on a separate network and updated their firmware.
How it compares
| feature | Botnet | Malware |
|---|---|---|
| What it is | Network of infected devices | Malicious software in general |
| Control | Coordinated by a remote attacker | Varies |
| Typical uses | DDoS, spam, proxies, credential stuffing | Theft, damage, spying |
| Owner awareness | Usually none | Varies |
Malware infects a device. A botnet links many infected devices into one weapon.
For analysts
I'd keep an inventory of smart devices on business networks and replace those without security updates. Unsupported cameras and routers are botnet recruits waiting to happen.
History & origin
Early botnets in the late 1990s and 2000s used chat networks called IRC to control infected Windows PCs. The Storm botnet in 2007 and Conficker in 2008 each infected millions of computers. In 2016, the Mirai botnet hijacked hundreds of thousands of cameras and routers using default passwords and knocked major websites offline by attacking DNS provider Dyn. Emotet, a long-running malware delivery botnet, was dismantled by an international police operation in January 2021, though it later returned for a time. In 2025, huge botnets built from compromised devices powered record-breaking DDoS attacks. In my view, botnets are the hidden cost of every insecure gadget plugged into the internet.