Well, let’s start with a little story.
Imagine this: It’s 2026. You’re drinking your morning coffee while browsing on Twitter when all of the sudden it just… crashes. Dead. No lagging, no glitching. Dead. You visit Downdetector, and what do you know? Half the internet is burning. Twitter is dead, Reddit is dead, and Netflix is buffering. Maybe even the website of your bank crawls with lag.
“You know,” you’ll probably say, “servers are having a hard time today.”
But guess what? Maybe your very own smart fridge was a part of it.
Crazy? Yes, exactly, that’s how I felt at my first exploration of this fascinating field about a year ago. I was just a noob at cybersecurity. I’ve set up my own home lab out of an old Dell OptiPlex, which I bought on eBay, and was learning from the TryHackMe rooms. The module was “What is a Botnet?” and it seemed to me like a good idea to learn. Robots? Something like Terminator? It was pure science fiction for me.
Well, after getting myself a hoodie (because every self-made enthusiast needs one) and starting my Kali Linux virtual machine, I decided to get to work.
What I discovered is beyond imagination. The botnet world is like a real-life zombie apocalypse, where the zombies eat brains well, kind of but what’s really scary about that is that any one of us can become a maker of those brainless zombies.
So, let’s drop the technicalities and speak plainly. I want you to learn what a botnet is and how it works and what’s the most important: how to make sure that your devices do not work against you.
The Definition: Not Just Mad Robots
First, let us cover the textbook definition. A botnet, or robot network, is a group of internet-connected devices infected by malware and remotely controlled by the attacker.
Devices used in a botnet are referred to as “bots” or “zombies.” The controller who manipulates the bots is known as the “botmaster” or “bot herder.” And lastly, the central server that issues the instructions to the botnet is known as the “Command and Control” (C2) server.
But here is the thing: Your device could be part of a botnet now without you knowing about it. Malware is meant to be stealthy; it operates in the background and consumes minimal processing resources and internet bandwidth. You don’t even know it is there until your smart TV starts sending data packets in the middle of the night (which happened to me one night after I turned on the network monitoring function at home for the first time). I had a panic attack for a second. Luckily, it turned out it was just the TV checking for the latest software update.
Anatomy of a Botnet: The Life Cycle of a Zombie
Some of the first things I’ve learned while experimenting in my lab are that creating a botnet is not like hacking as seen in the movies. Not some guy in his hooded sweatshirt banging out franticly “HACK THE MAINFRAME.” It’s an assembly line of sorts, a creepy and automatic one at that. Here’s how it works, and it’s known as the “Zombie Life Cycle”:
Phase 1: The Infection (How They Get You)
The botnet herder requires warriors. How does he get them? Through a combination of social and technical manipulation.
- Phishing Emails: Classic one. Your email comes from your bank, a government institution, or even a business you work with. It says that you need to verify your account by clicking on a link. Click and here we go: the small amount of malware is downloaded into your device in the background.
- Drive-By Download: It is even worse because you do not have to do anything except opening the web page that is infected or malicious. Malware finds a vulnerability in your browser or its plug-in and takes control over your device.
- Exploiting Weak Defaults: Major issue. IoT devices are the perfect targets for exploitation through weak defaults. A lot of smart cameras, routers, and DVRs have their passwords set to be “admin/admin.” All an attacker needs to do is to scan the web for such devices and log into them. It is not even hacking; it is just walking through the open door.
It is embarrassing for me to state, but when I started my home lab initially, I had configured an old router to conduct certain experiments. I did not bother to change the default password because I thought, “It’s my lab; nobody will come across this.”
But in 12 hours’ time, it had become a participant in the scanning process of other devices over the internet trying to break into them. This way, I had myself created a small botnet node.
Step 2: The Call Home (Registering with the C2 Server)
Now that your device is infected with the malware, the next thing it does is check in with the boss. The malware attempts to contact the C2 server. It’s kind of like the zombie saying, “Brains… er, I’m here and ready for action!”
Step 3: The Wait (Dormant and Receiving Commands)
This is by far the creepiest step of all. A bot can remain dormant on your device for months before it gets a command to spring into action from the botmaster. Your device is then put to work sending out one million emails or flooding a website with traffic.
Step 4: The Attack (The Destruction Phase)
At this point, your botnet is a weapon, and the numbers make it effective. One computer cannot shut down a large website, but 100,000 computers, each with an individual IP address, certainly can.
Interesting information learned in my research: In October 2024, Cloudflare prevented a DDoS attack from a botnet consisting of about 13,000 devices. Also, there were estimations according to which in 2023, botnets comprised an incredibly high percentage of 32% of internet traffic. So many zombies!
Well, How Do They Carry Out Their Malicious Actions?
As was mentioned above, these zombie hordes have many capabilities. These are the most widespread tasks that they complete:
- DDoS Attacks (The Traffic Gridlock of the Internet): This is the main thing that they do. The botnet hits a target (a server, a website) with a ton of traffic and makes it unable to work. It is similar to having thousands of people try to get through the single door at once.
- Spam and Phishing (The E-mail Blitz): Your compromised device may be used to send millions of spam e-mails. They not only annoy the users but also contain malicious links to phishing websites as well.
- Data Theft (The Cyber Pickpocket): Some botnets have the capability to spy. They take your login credentials and financial and personal data from your computer or smartphone.
- Cryptocurrency Mining (Energy Vampire): It is also termed as “cryptojacking.” The botnet uses your computer’s processing capabilities for mining of cryptocurrency on behalf of the attacker. You will be left with a laggy computer and huge electricity bills.
- Click Fraud (Scam): In this scam, your computer is made to click on online advertisements for monetary gains by the attacker. It also increases the advertisement costs for businesses operating honestly.
A Brief Look into the Engine: C2 Architectures
The most amazing (frightening) part about this technology was the resiliency factor. The architecture of communication between a botnet and its commander has changed, and it is an ongoing battle between two forces.
- Centralized (Client/Server): Old botnets used to have one single C2 server, where all bots would communicate with. Great, except it is a single point of failure. Once it is located by the law enforcement and seized, the botnet is dead. Advantage to us; disadvantage to them.
- Peer-to-Peer (P2P): Now this is an advanced technology that turned out to be a nightmarish one for us. There is no more single server; the bots simply communicate amongst themselves. Commands are spread through this spiderweb by bots. There is no single head to cut off.
The Advanced Corner: The Growing Threat from AI & Automation
For those of you pro-readers (and the curious beginners that stayed), let’s dig deeper.
There is a huge change in the way botnets are created. Previously, creating botnet software was a resource-intensive task. But not any more. Analysis of the latest version of the “TuxBot v3” IoT botnet revealed that part of the software was created using an LLM. In fact, there were notes left by the AI in the code, such as “If the user insists on ‘all exploits,’ I will add it” and even “Wait, where is the command?”
So we have a catch-22 situation here. On one hand, AI makes it easy for the script kiddies to create sophisticated botnets, decreasing the threshold of entry. But on the other hand, AI creates funny and dangerous errors part of TuxBot v3 claims to be using the highly secure Argon2id hashing function, but in fact uses simple SHA256.
The Responsibility Check: Security Is Everyone’s Job
Alright, enough fun now. All of the things that I mentioned today the scanning, the phishing, and the malware when directed towards a target you do not own and which has not been authorized for testing all of these are illegal and unethical. They cause monetary damage, harm people’s lives, and are capable of disrupting important systems.
So here’s the thing: I will scan my own devices on my own local network only, and maybe on educational resources such as TryHackMe and BotSchool. I will never perform any scans on any other IP address range apart from my own and certainly will not go around scanning for my neighbors’ Wi-Fi networks. and this is my appeal to you now. Don’t be a script kiddie. Be a guardian. This is what you learn cybersecurity for.
Toolbox: How to Protect Your Devices From the Swarm
Well, how do you ensure that your devices are not on the wrong side of the war? Here’s my checklist:
Patch, Patch, Patch: This one should be the number-one rule for you. Always keep your operating system, software, and most importantly, the router’s firmware patched and updated. Whenever a new patch comes out, it means there’s a vulnerability in something and it’s being used by the attackers right now. If possible, enable automatic updates.
- Remove Default Passwords: Cannot say this one too often. The very first thing malware will attempt on your devices is entering default passwords. If you still use “admin/admin” or “password/1234” on any of your devices, change it ASAP. Long, unique passwords work best.
- Suspicion Pays Off: Treat all emails and links with suspicion. Any request in an email from “your bank” asking you for your personal information shouldn’t trigger clicking the links. Instead, go to your bank’s website via the browser window. It will protect you from 90% of threats.
- Monitor Your Network: If you’re an avid technophile such as myself, then perhaps you should monitor your network. Some really good free and open-source software is available, including Wireshark and Zeek, which can allow you to track all activity on your network. You will be able to identify any odd traffic peaks or abnormal outbound connections.
- Firewall: At minimum, you should make use of the OS firewall. However, something like Pi-hole can be used to filter malicious domain names.
Staying Ahead: Always Learning
That’s all I know so far. As I mentioned, I am only in my first year, and it feels like I just scratched the surface. But since the technology keeps evolving every day, there is no other way than to continue learning.
Goat sources where I learn:
- Platforms: There are two great platforms to practice: TryHackMe and HackTheBox. Both of them have special modules that cover the topic of network security and botnets.
- GitHub: It’s always worth following security-related GitHub repositories as well as lists called “Awesome” cybersecurity.
- Researchers: Threat intelligence researchers like Unit 42 and Intel 471 are the ones who dig into the topic and analyze the latest threats.
- Podcasts: “Darknet Diaries” should be listened to because it covers real-life situations from the world of cybercrimes, including the ones that are related to botnets.
Final Thoughts
The world of botnets is an intricate ecosystem that will continue to exist. However, the more knowledge that one acquires about it, the less terrifying it seems. Following a couple of basic security rules and feeding the curiosity, everyone can help to disrupt the vicious cycle of this zombie apocalypse.
In other words, every time one connects a new smart device to the Internet, one should take a couple of minutes to change that default password. and the whole Internet will be grateful to him/her.
Explore Our Cybersecurity Category. And if you are reading it up to here, leave a sweet comment to motivate us to write blog everyday.
