Botnets
Botnets are networks of compromised devices controlled remotely by attackers. They are often used to flood targets with traffic, steal data, or rent out access. Once a device is infected, it quietly follows remote instructions along with thousands of others, acting as part of a larger swarm.
How Do Botnets Operate?
Botnets follow a fairly predictable life cycle, even though technical details vary across families. Breaking it down makes it easier to see how attackers build and maintain these networks:
- Infection
- Phishing emails that trick users into running malicious attachments or clicking links that install malware.
- Weak or reused passwords that allow brute-force logins on services like remote desktop, routers, or cameras.
- Unpatched software where known flaws are exploited to silently install code. IoT devices and older systems are frequent targets.
- Misconfigured services left open to the internet, such as unsecured databases, cloud storage buckets, or admin panels.
Once infected, the device installs a small program called a bot. This bot hides in the background, waiting for instructions while avoiding detection.
- Command Channel
- Centralized servers – easy coordination, but a single point of failure.
- Peer-to-peer connections – each bot relays instructions, making the botnet harder to disrupt.
- Domain Generation Algorithms (DGAs) – bots generate thousands of domains daily, checking until they find the active one.
- Fast-flux DNS – domains resolve to constantly changing IPs, distributed across infected machines.
These resilient communication methods make it challenging for defenders to block attacker control.
- Execution
- Denial-of-service (DoS) attacks – overwhelming targets with traffic.
- Credential stuffing – testing stolen username/password pairs on online accounts.
- Spam distribution – sending large volumes of phishing or scam emails.
- Cryptocurrency mining – hijacking resources to mine digital currency, wearing out hardware and increasing electricity costs.
- Proxy services – routing malicious traffic through infected devices to hide attacker activity.
Thousands of bots can be activated simultaneously with a single command, making botnets powerful and dangerous.
Tricks that keep them running
- Domain Generation Algorithms (DGAs): malware creates countless possible command-and-control domains each day, searching for one that is live.
- Fast-flux DNS: domains rapidly rotate across infected devices, masking the true controller.
Botnets in 2025
The size and intensity of botnet activity continue to climb:
- Attack volumes: Cloudflare reported blocking 20.5 million denial-of-service attacks in Q1 2025, a 358% increase compared to the year before. Hundreds of them peaked above one terabit per second.
- Application-layer floods: Recent quarters have seen a rise in Layer-7 attacks against financial services, retailers, and tech firms.
- Record bursts: Some attacks in 2025 reached over 7 terabits per second, with bursts so short that human response would have been too late. One case delivered 37 terabytes in less than a minute to a single target.
- Bot traffic share: According to Imperva, nearly a third of all web traffic now comes from malicious bots, meaning automated traffic is nearly as common as legitimate users.
What are the Types of Botnets?
- IoT botnets: Malware such as Mirai continues to hijack routers, security cameras, and smart gateways. Attackers often exploit old or abandoned devices that never receive patches.
- Server and cloud botnets: Newer strains like P2PInfect spread through poorly secured services such as Redis, deploying miners or ransomware payloads.
- Residential-proxy botnets: Infected computers are used as stepping stones, masking criminal activity by routing traffic through ordinary households. The takedown of 911 S5 revealed more than 19 million hijacked IPs across the globe.
- Enterprise-targeting botnets: Recent research showed how attackers abuse Windows Domain Controllers to generate powerful amplification attacks.
Biggest Botnet Disruptions in 2025
- QakBot (QBot): Taken down in 2023 through an international operation after infecting hundreds of thousands of systems. It was a launchpad for major ransomware campaigns.
- Mozi: Once one of the largest IoT botnets, it was abruptly disabled in 2023 when its operators pushed a kill switch, likely under law enforcement pressure.
- 911 S5: In 2024, arrests and seizures exposed how botnets can fuel large-scale fraud by selling proxy access.
Defense Strategies To Stop Botnet Attacks
Reduce exposure
- Keep software, firmware, and hardware up to date.
- Replace unsupported IoT and networking devices.
- Change default credentials and disable unnecessary services like UPnP.
Detect malicious control channels
- Monitor outgoing traffic for patterns that match DGAs or fast-flux techniques.
- Use DNS filtering and threat intelligence feeds to block suspicious activity.
Mitigate attacks in progress
- Implement always-on edge protection for both infrastructure and application layers.
- Prepare automated playbooks to absorb floods that may only last seconds.
Protect users and APIs
- Apply multi-factor authentication across services.
- Use tools that detect credential stuffing and abnormal login attempts.
- Secure APIs with throttling, token validation, and bot scoring.
Support takedowns
- Share threat data with service providers and security groups.
- Participate in industry efforts that have successfully disrupted botnets in the past.
Tips for individuals
- Regularly update operating systems, apps, and devices.
- Use unique passwords stored in a password manager, along with multi-factor authentication.
- Be cautious of free software bundles or cracked programs, which are often laced with malware.
Final thoughts
Botnets are no longer limited to compromised PCs. They now span across consumer devices, cloud services, and even enterprise systems. With attack peaks reaching terabit levels and traffic patterns designed to mimic human users, defenders must rely on layered defenses, constant monitoring, and active cooperation across the industry.
