A botnet is a network of infected devices — laptops, servers, routers, cameras — that an attacker controls remotely without the owners knowing. Each infected device (a "bot" or "zombie") obeys commands sent by the attacker through a hidden channel, and thousands of them acting together can flood websites offline, crack passwords at scale, or send waves of spam and phishing. For the owner, the tell-tale sign is usually nothing at all: the device works normally while quietly doing someone else's work in the background.
TL;DR
- A botnet is thousands of infected devices controlled as one network by an attacker.
- Devices are recruited by malware from phishing links, weak passwords and unpatched software.
- Botnets power DDoS attacks, credential stuffing, spam and malware distribution.
- Home routers, cameras and smart devices are favourite targets because they are rarely patched.
- Strong passwords, MFA, patching and reporting unusual device behaviour keep your devices out of one.
What a botnet means in plain terms
"Bot" is short for robot: a program that follows instructions. A botnet is a bot network — many infected machines running the attacker's program, waiting for orders. The attacker who controls it is sometimes called the "botmaster" or "herder". The infection usually arrives the same way other malware does: a user clicks a malicious link or attachment, or the device is exposed to the internet with a default or weak password.
What makes a botnet different from ordinary malware is scale and coordination. One infected laptop is a problem for one business. Fifty thousand infected devices acting in unison is a weapon — capable of knocking a bank's website offline, testing millions of stolen passwords, or delivering the next wave of phishing emails.
How a botnet grows, step by step
- Infection. Malware lands on a device through a phishing link, a software flaw, a weak or default password on an internet-facing device, or a malicious download.
- Recruitment. The malware phones home to the attacker's command system and registers the device. Modern botnets hide this channel across many relay servers to avoid takedown.
- Waiting. The device sits quietly. It may scan for other vulnerable devices and recruit them too — that is how a botnet snowballs.
- Command. The attacker sends instructions: flood this website, try these million stolen passwords, send these 10 million spam emails, or download and install more malware.
- Monetisation. Botnets are rented out as a service. The owner of the botnet sells attack capacity to others, which is why botnets persist even after the original operator is arrested.
What botnets are actually used for
| Use | What it looks like | Why it matters to a small business |
|---|---|---|
| DDoS attacks | Thousands of devices flood a target with traffic until it goes offline | Your website or SaaS provider can go dark, and your own devices can be the weapons |
| Credential stuffing | Bots try millions of username and password pairs against login pages | One reused staff password can unlock a business account — see what is credential stuffing |
| Spam and phishing delivery | Bots relay millions of emails to bypass blocklists | Some of the phishing emails your team receives were sent by a botnet |
| Proxy services | Bots are rented as anonymous internet exits | Attackers browsing "as you" means your IP appears in someone else's attack logs |
| Malware distribution | Bots host and spread the next payload | Infected devices push ransomware and info-stealers to new victims |
Why routers and smart devices make the best bots
Laptops get antivirus updates. Cameras, network-attached storage, printers, doorbells and internet routers frequently do not — and many still ship with admin passwords like "admin" or a default printed on the box. The Mirai botnet, first documented in 2016, recruited hundreds of thousands of such devices by trying a short list of default passwords, and its code still powers copycat botnets today. A small business with an unpatched router on a default password is contributing capacity to one of these networks without knowing it.
How to keep your devices out of a botnet
| Layer | Control | What it stops |
|---|---|---|
| Passwords | Unique, strong admin passwords on every router, camera and IoT device | The default-password scanning most IoT botnets rely on |
| Patching | Firmware and OS updates applied promptly | The known flaws botnets exploit to recruit |
| Exposure | Devices not reachable from the internet unless they must be | Shrinks the attack surface to near zero for most offices |
| Endpoint security | Antivirus and endpoint protection on all computers | Detects and removes bot malware on laptops and servers |
| Identity | MFA on every business account | Makes stolen-password stuffing useless |
| People | Staff report a slow, hot or oddly behaving device | A recruited machine gets cleaned instead of silently serving |
That last layer is the one teams forget. A computer that suddenly slows, runs its fan hard at 3am, or loses internet intermittently may be doing attacker work in the background. Cyber Aware's security awareness training teaches staff to treat exactly those symptoms as reportable, and human risk reporting shows whether the reporting habit is forming across the team.
FAQ
What is a botnet in cyber security? A network of malware-infected devices that an attacker controls remotely, usually without the owners' knowledge. Thousands of bots acting together are used for DDoS attacks, credential stuffing, spam and distributing further malware.
How do devices get infected and become part of a botnet? Through phishing links and malicious attachments, unpatched software flaws, and default or weak passwords on internet-facing devices like routers and cameras. Once infected, the malware quietly connects to the attacker's command system and waits for instructions.
Can my computer be in a botnet without me knowing? Yes — that is the design. Bot malware avoids crashing the device or showing windows, so the machine works normally while relaying spam or joining attacks. Unusual slowness, heavy network use or the fan running at night are the symptoms worth reporting.
What is a DDoS attack? A distributed denial-of-service attack: a botnet floods a website or service with so much traffic that legitimate users cannot reach it. The target's own systems are healthy — they are simply overwhelmed.
Are home routers and IoT devices really used in botnets? Yes, and they are the favourite targets. Devices that rarely get firmware updates and often keep default passwords can be recruited by automated scanning. Mirai, first documented in 2016, recruited hundreds of thousands of them this way.
How do I check whether a device is infected? Look for the symptoms: persistent slowness, the fan running hard when idle, unfamiliar network activity, or the device phoning home to unknown addresses. Run a full antivirus scan, apply pending updates, change its passwords, and if anything still feels wrong, have IT rebuild it from a clean image.
One last thing
Walk your office and list every device with a web login: router, cameras, printer, storage box. If any of them still uses the password on its sticker, changing it today removes you from the easiest recruitment pool botnets have. Then ask whether staff know to report a machine that "just seems slow lately" — if the answer is no, that is a gap assessment conversation.