Botnet
Also known as:
Bot Network
Zombie Army
Zombie Network
Definition
A botnet is a network of internet-connected devices infected with malware and controlled remotely by an attacker, often without the owners knowing. Each infected machine, called a bot or zombie, follows commands from a command-and-control server. Botnets are the engine behind most large DDoS attacks, spam campaigns, and credential-stuffing, because they let one attacker direct the firepower of thousands or millions of devices at once.
Popular reads
View All
Payment System Design: Ledger, Idempotency, and Settlement
Jul 18, 2026
X Algorithm Explained: How the Open Source Recommendation System Works
Jan 22, 2026
Cursor Skills: How to Create and Use Agent Skills
Jun 23, 2026
The Complete HTMX Guide: From Zero to Production
Dec 22, 2025
Complete Guide to Graph Data Structure: BFS, DFS, Adjacency List vs Matrix
Jan 20, 2026
Transactional Outbox Pattern: Never Lose an Event Again
Apr 07, 2026
Key Takeaways
- A botnet is a fleet of malware-infected devices an attacker controls remotely to act in unison.
- Cheap, always-on IoT devices like cameras, routers, and TVs are prime targets because of weak default passwords.
- Botnets provide the distributed firepower that turns a simple DoS into a DDoS attack.
- You can rent botnet time on underground markets, which is why DDoS-for-hire (booter) services are so common.
How It Works
- Malware spreads by scanning for devices with known vulnerabilities or default credentials and infects them.
- Each infected bot phones home to a command-and-control (C2) server and waits for instructions.
- The operator issues a single command, such as flood a target IP, and every bot obeys at once.
- Because traffic comes from many legitimate-looking devices worldwide, it is hard to block by source.
Where It Is Used
- The Mirai botnet infected IoT devices and launched the 2016 attack that took down DNS provider Dyn.
- The Aisuru-Kimwolf botnet, an estimated 1 to 4 million infected devices including Android TVs, drove the record 31.4 Tbps attack Cloudflare mitigated in 2025.
- Modern botnets are rented out through DDoS-for-hire services, lowering the skill needed to launch an attack.