What Is a Botnet?

A botnet is a network of computers or internet-connected devices that have been compromised by malware and placed under the remote control of an attacker, referred to as the botmaster or bot herder. Each infected device, called a bot or zombie, continues to operate normally from the perspective of its owner while simultaneously executing commands issued by the attacker. The NIST Computer Security Resource Center defines a botnet as a network of bots that the criminal can remotely manage, typically established through Trojan malware that breaches the security of multiple users' machines without their knowledge. Botnets are the operational infrastructure behind distributed denial-of-service attacks, large-scale spam campaigns, credential stuffing operations, and cryptocurrency mining abuse.

Infection typically begins through phishing emails, drive-by downloads from compromised websites, exploitation of unpatched software vulnerabilities, or brute-forcing of weak credentials on internet-exposed services. Once a device is infected, the malware contacts the command-and-control (C2) infrastructure to register the new bot and receive operational instructions. The botmaster can then issue commands to some or all enrolled devices simultaneously, coordinating actions at a scale no single host could achieve.

Command-and-Control Architectures

The structure of a botnet's C2 infrastructure has significant consequences for how resilient it is to disruption. Centralized architectures use one or more dedicated C2 servers that all bots contact for instructions. This model is operationally efficient but fragile: law enforcement agencies and network operators can dismantle a centralized botnet by seizing or null-routing its C2 servers. Peer-to-peer architectures eliminate this single point of failure by having bots communicate directly with a subset of other bots, propagating commands through the network by gossip protocols. Peer-to-peer botnets are substantially harder to disrupt because there is no authoritative server to take down. A third model, fast-flux DNS, rotates the IP addresses associated with C2 domain names at high frequency, making blocking by IP address ineffective and impeding forensic attribution.

Research published through IEEE Xplore on botnet detection and mitigation documents network-level and host-level techniques for identifying botnet traffic, including flow analysis, DNS behavior profiling, and machine learning classifiers trained on the distinctive communication patterns that C2 protocols generate.

Botnet-Driven Attacks

The primary capability a botnet provides is scale. A distributed denial-of-service attack from a botnet with tens of thousands of nodes can generate traffic volumes that overwhelm the upstream bandwidth of all but the largest content delivery networks and cloud providers. Spam botnets distribute billions of messages daily using the legitimate internet connections of compromised home and office machines, making source-based filtering difficult. Credential stuffing campaigns replay stolen username-and-password pairs against banking, e-commerce, and email services, succeeding whenever a victim has reused a credential. More recently, botnet operators have deployed their infected fleets to mine cryptocurrency by consuming the CPU and GPU resources of compromised hosts, monetizing the botnet without requiring the direct theft or sale of data.

Law enforcement takedowns of major botnets, including Emotet in 2021 and Qakbot in 2023, have demonstrated that coordinated international action can disrupt even large and well-engineered criminal infrastructure, though replacement botnets typically emerge within months. NIST's guidance on botnet threats, collected through the NIST Computer Security Resource Center botnet topic page, catalogs technical reports, detection methodologies, and mitigation guidance relevant to operators of enterprise and critical infrastructure networks.

Applications

Botnet research and mitigation has applications in a wide range of security domains, including:

• Network intrusion detection, where botnet traffic patterns are incorporated into detection signatures
• Distributed denial-of-service mitigation services that absorb and filter botnet attack traffic
• Law enforcement investigations into computer fraud and organized cybercrime
• Internet of Things security, where poorly secured devices are a primary recruitment vector for new botnets
• Threat intelligence, where tracking active botnets informs vulnerability patching priorities across industry sectors