Botnet

What is a Botnet?

A botnet is a network of internet-connected devices that have been infected with malware and are secretly controlled by an attacker. Each infected device, called a bot, can be commanded remotely, allowing the attacker to use thousands of hijacked computers, servers, and smart devices together to carry out large-scale attacks.

How It Works

A botnet forms when malware quietly infects a device and connects it back to the attacker’s control system, often called a command-and-control server. The device continues working normally, so the owner rarely notices anything is wrong.

Once enough devices are infected, the attacker can direct them all at once. Botnets are commonly used to launch distributed denial-of-service attacks that overwhelm a target with traffic, to send massive volumes of spam and phishing email, to spread more malware, or to steal data across many machines at once.

Almost any connected device can be conscripted, including computers, servers, routers, and poorly secured smart devices. Weak passwords, unpatched software, and missing security controls are the usual ways a device gets recruited into a botnet.

Why It Matters

Botnets matter for two reasons. First, your devices can be hijacked and used to attack others without your knowledge, which can harm your reputation and consume your resources. Second, your organization can be the target of a botnet-powered attack, such as a DDoS attack that takes your systems offline. Strong endpoint protection, patching, and network monitoring are what keep your devices out of botnets and defend against them.

Related Terms

• What Is Malware?
• What Is a DDoS Attack?
• What Is a Threat Actor?
• What Is Endpoint Detection and Response (EDR)?

For a complete guide, read our full article on how medical clinics actually get breached.

SecTec keeps your devices protected and monitored as part of our network and endpoint security service.