A botnet is a network of internet-connected devices that have been secretly infected with malware and brought under the remote control of an attacker. Each compromised device — called a zombie or bot — follows the attacker's commands without the owner's knowledge, often being used to send spam, launch cyberattacks, or steal data at scale.
How is a botnet built?
Building a botnet begins with spreading malware — typically a trojan or a worm — to as many devices as possible. Infection routes include:
- Phishing emails with malicious attachments or links
- Drive-by downloads from compromised websites
- Exploiting unpatched software vulnerabilities
- Weak or default passwords on routers, smart devices, and webcams
Once infected, a device silently connects to a command-and-control (C&C) server run by the attacker. The attacker can then issue commands to all infected devices simultaneously. The owner typically notices nothing — the malware runs quietly in the background, using only a fraction of the device's resources.
| Stage | What happens |
|---|---|
| 1. Recruitment | Malware infects devices via phishing, exploits, or weak credentials |
| 2. Infection | Trojan installs itself, connects to C&C server, awaits commands |
| 3. Operation | Attacker sends commands; all bots execute simultaneously |
| 4. Concealment | Activity is disguised; antivirus evasion techniques used |
| 5. Discovery | ISP, security researchers, or law enforcement detect and disrupt |
What are botnets used for?
Distributed Denial-of-Service (DDoS) attacks — the most well-known use. Thousands of bots simultaneously send requests to a target web server, overwhelming it with traffic until it crashes or becomes unreachable. A botnet of 100,000 devices can generate traffic no single organisation's server can withstand. DDoS-for-hire services (called "booter" or "stresser" services) allow criminals to rent botnet capacity to attack a target on demand.
Spam campaigns — botnets send billions of spam and phishing emails per day. Because the emails originate from thousands of different, legitimate-looking IP addresses (ordinary people's home connections), they are far harder to block than spam from a single server.
Credential stuffing — botnets systematically try stolen username-password pairs across thousands of websites, finding accounts where the same password was reused.
Cryptomining — the attacker uses the bots' collective processing power to mine cryptocurrency, with the electricity bill paid by the victims.
Data theft — the malware logs keystrokes, steals stored passwords, and exfiltrates banking details from all infected devices.
How large can a botnet become?
Mirai botnet (2016): ~600,000 IoT devices (cameras, routers, DVRs)
Launched a DDoS attack of ~620 Gbps against
security researcher Brian Krebs's website —
then ~1 Tbps against Dyn DNS, taking down
Twitter, Netflix, Reddit, and others.
Conficker worm (2008-09): ~9–15 million Windows PCs infected
Never used to its full capacity — likely a
financial botnet for spam and pay-per-click fraud.
Necurs (2012-2020): ~9 million devices at peak
Responsible for distributing Locky ransomware
and pump-and-dump stock fraud spam.
The Mirai botnet was notable for targeting Internet of Things (IoT) devices — smart cameras, baby monitors, and home routers — which are frequently shipped with default passwords that users never change and which run stripped-down operating systems that rarely receive security updates.
How can you avoid your device becoming a bot?
| Action | Why it helps |
|---|---|
| Keep software and firmware updated | Patches remove the vulnerabilities malware exploits |
| Change default passwords on routers and IoT devices | Brute-force tools try default credentials first |
| Use reputable antivirus software | Detects and removes known bot malware |
| Be cautious with email attachments and links | Phishing is the primary recruitment method |
| Use a firewall | Blocks unexpected outbound connections to C&C servers |
| Use strong, unique passwords | Stolen credentials cannot be reused across sites |
What happens when a botnet is taken down?
Law enforcement agencies and cybersecurity organisations work together to disrupt botnets through sinkholing — redirecting the C&C server traffic to a server they control, cutting the attacker's connection to their bots. Legal action follows, sometimes internationally coordinated (Europol's Operation Downloader and the FBI's Operation Ghost Click are well-known examples). Even after a takedown, infected devices remain infected until cleaned, so victims must disinfect their machines independently.
Frequently asked questions
What is a botnet in simple terms for GCSE?
A botnet is a large group of computers or other internet-connected devices that have been infected with malware without their owners' knowledge. An attacker remotely controls all these "zombie" devices at once, using their combined power to launch attacks, send spam, or steal data. The owners typically have no idea their device is part of a botnet.
What is the difference between a botnet and a DDoS attack?
A botnet is the infrastructure — the network of compromised devices. A DDoS (Distributed Denial-of-Service) attack is one of the things a botnet can be used to carry out. In a DDoS attack, the attacker commands many bots to flood a target server with traffic simultaneously, overwhelming it. A DDoS attack requires a botnet (or some other source of distributed traffic) to be effective.
How do I know if my computer is part of a botnet?
Symptoms can include: unusually slow performance when the computer is idle; high network activity with no obvious cause; the computer taking longer than usual to shut down; unexplained increases in data usage. However, sophisticated botnet malware is designed to be undetectable. Running up-to-date antivirus software and keeping your operating system patched is the most reliable protection.
What is the legal position on botnets in the UK?
Operating or using a botnet is a serious criminal offence in the UK under the Computer Misuse Act 1990 (as amended). Creating malware, infecting systems without authorisation, and launching DDoS attacks are all criminal offences carrying custodial sentences. Being unknowingly part of a botnet (as a victim) is not an offence, but you are still obliged to clean your device if you become aware of it.
Explore cybersecurity threats and the law with Professor Turing at aitutors.me — Socratic questioning to deepen your understanding, never just keyword lists.