Botnet

What is a Botnet?

A botnet is a network of Internet-connected devices (e.g. computers, mobile devices, etc.), hijacked using malware and controlled by a digital adversary (sometimes known as a “botmaster” or “bot herder”). 

Digital adversaries can use botnets to execute a range of cyber crimes and digital threats, including launching DDoS attacks, sending spam messages via email or social media, and even mining cryptocurrency. The word “botnet” is a portmanteau of the words “robot” and “network”.

How Do Botnets Work?

Building or Renting a Botnet

Before they can launch an attack, digital adversaries must gain access to a botnet. Botnets can be purchased or rented on dark web hacker forums, but it’s also possible to create one. To create a botnet, a digital adversary might build (or purchase) an exploit kit that can exploit software vulnerabilities on target machines and deliver the bot as a malware payload.

Infecting Target Machines with a Bot

To create a botnet, digital adversaries must infect as many machines as possible with their bot. Bots are a type of malware that can be spread by digital adversaries through malicious email and social media attachments, malicious domains, drive-by downloads, web browser vulnerabilities, and a variety of other attack vectors.

Commanding and Controlling Infected Machines

Once a machine has been infected, the bot will have the infected machine connect to a command-and-control server where it comes under the control of the digital adversary. Once this connection is formed, the digital adversary can exfiltrate data from the infected machine, spy on the user by monitoring keystrokes, steal the victim’s personal data, or execute commands on the infected machine.

Executing Malicious Cyber Attacks

Once a digital adversary has built a large botnet by infecting and controlling web-connected machines, they can use that network to launch cyber attacks against individual or enterprise targets. Botnets are commonly used to launch DDoS attacks against targeted websites or digital services, steal sensitive data, mine cryptocurrency, spread misinformation, and deploy malware.

Participating in the Botnet Economy

A digital adversary who creates a botnet can now sell or rent that botnet to other cyber criminals. If your device becomes part of a botnet, it could be used by multiple cyber criminals to commit digital crimes.

What Can Cyber Criminals Do With a Botnet?

Launch DDoS Attacks

A DDoS attack is when a digital adversary uses a botnet to disrupt a website or online service by bombarding it with junk traffic. This can result in service interruptions and operational downtime with financial consequences for the targeted organization.

Send Spam Messages

Botnets can be used to distribute huge volumes of spam via email or social media. Researchers have estimated that botnets are responsible for as many as 85% of the 100+ billion spam messages sent per day. These spam messages often include malicious attachments or links to other scams.

Mine Cryptocurrencies

Digital adversaries are now creating botnets that allow them to mine cryptocurrency on the infected machines. 

Spread Misinformation

Digital adversaries can use botnets to spread misinformation by commanding infected machines to spread false propaganda messages on public forums and social media. 

Steal Sensitive Data

Digital adversaries can tell when one of their bots infects a machine within an enterprise network. When this happens, the adversary may start spying on the machine in hopes of stealing the organization’s sensitive data. 

What if My Computer is Part of a Botnet?

If a digital adversary launches a successful malware attack against you, your machine could become part of a botnet. All kinds of connected devices (e.g. PC, Apple, Smartphones, etc.) are vulnerable to malware bots and an infected machine often appears to be functioning normally.

Here’s what can happen if your device becomes part of a botnet:

Stolen Personal/Sensitive Data

If your machine was infected by malware and connected to a botnet, there’s a good chance that personal data was stolen from your machine and exfiltrated to the botmaster. Malware bots can steal your data by spying on your activity with keylogger functionality, or accessing passwords saved on your device and transmitting them to the botmaster.

Poor Computer Performance

Poor computer performance is a typical consequence when your device becomes part of a botnet. Commands from the botmaster will hijack your computer’s processing power, diverting resources away from other applications and resulting in slower performance and a degraded user experience. Botnets that mine cryptocurrency will often degrade the performance of infected machines.

High Bandwidth Consumption

Digital adversaries can direct machines in their botnets to transmit large files over the Internet, driving high bandwidth consumption that results in huge Internet bills for the device owner. DDoS attacks and email spam can both consume large volumes of Internet bandwidth.

How to Protect Against Botnet Risks

Practice Good Cyber Security Hygiene

Practicing good cyber hygiene can prevent malware bots from infecting your devices. This includes basic security practices like verifying the sender of an email before opening it, learning to recognize suspicious communications, and never opening suspicious links or attachments without confirming the source.

Update Installed Software Regularly

Digital adversaries can infect devices with malware by exploiting known security vulnerabilities. Bots that can scan for more vulnerabilities are more valuable because they infect devices more efficiently. Regularly updating and patching installed software programs on your devices reduces your vulnerability to infection from malware bots.

Deploy Anti-Phishing Software

Anti-phishing software is effective at proactively protecting your devices against phishing attacks that originate from across the public attack surface, including email, social media, business collaboration tools, and the surface, deep, and dark web. 

Anti-phishing software works to identify phishing and malware-based attacks against your infrastructure and dismantle the infrastructure behind them to discourage future attacks.

Protect Your Organization Against Botnet Threats with ZeroFox

ZeroFox anti-phishing software provides digital risk protection and adversary disruption to safeguard enterprises and their web-connected devices against phishing scams that can lead to malware bot infection.

Additionally, our ZeroFox Intelligence Search gives enterprises access to our vast logs of compromised credentials and IPs from known botnets - information they can use to accelerate investigations or bolster defenses against botnet spam and DDoS attacks.

Want to learn more?

Read our white paper on The Top 5 Social Media Security Risks to discover how digital adversaries are using social media to spread malicious links and infect devices with malware bots.