How botnets turn millions of home devices into a global attack network

At any given moment, researchers estimate that millions of internet-connected devices are taking instructions from someone other than their owner. Not a visible hijack — no ransom note, no obvious slowdown. The device still streams video, still routes traffic, still does its job. It also does a second job: passing traffic, testing stolen passwords, or attacking a server on the other side of the world. The owner will never receive a bill for any of it.

The architecture behind this is called a botnet — a network of compromised machines, each one a bot, all answering to a central command layer called command-and-control infrastructure, or C&C. The person running it is the botmaster. The scale ranges from a few thousand devices to tens of millions: the 911 S5 network, dismantled by US authorities in May 2024, managed 28 million infected IP addresses over a decade.

How devices get recruited

Most device compromise happens through one of two routes. The first is weak credentials: routers, cameras, and digital video recorders ship from factories with default passwords — “admin,” “1234,” or nothing at all. Internet-scanning tools can enumerate hundreds of thousands of devices with those defaults active in under an hour. The second is vulnerability exploitation: firmware bugs in consumer-grade hardware often go unpatched for years. The Mozi botnet spread to over 1.5 million devices almost entirely through known remote-code-execution flaws in routers and DVRs whose owners had never applied an update. Once compromised, the device immediately begins scanning for its next victim — the infection becomes self-sustaining.

Three architectures, three levels of resilience

The simplest C&C model is centralized. Early botnets used IRC channels; the botmaster typed a command, every connected bot executed it. Modern centralized botnets use HTTP or HTTPS, with devices polling a URL at regular intervals. The architecture is easy to build and fast to operate, but it has one structural weakness: a single point of failure. Security researchers and law enforcement have dismantled hundreds of centralized botnets by seizing the C&C server or redirecting its domain to a harmless sinkhole. The entire network loses contact within hours.

Peer-to-peer botnets were engineered to survive that kind of takedown. In a P2P architecture, each bot acts as both a client and a relay node. The botmaster injects a command at any arbitrary entry point; it propagates through the network the way information travels through a crowd. There is no single chokepoint to disrupt. The Mirai botnet — which in 2016 took down DNS provider Dyn and knocked Twitter, Netflix, and Reddit offline across much of the United States and Europe — used elements of both centralized and P2P design. Its successors have moved further toward pure P2P structures.

The third layer of resilience is the domain generation algorithm, or DGA. Instead of contacting a fixed server address, DGA-equipped malware generates thousands of candidate domain names algorithmically each day, from a shared seed that only the botmaster knows. Defenders blocking one domain have no effect — the bot tries the next one in sequence. Taking down a DGA-equipped botnet requires either predicting the algorithm and pre-registering all candidate domains, or deploying machine-learning-based DNS filtering that recognizes the statistical fingerprint of algorithmically generated names.

What a botnet actually does

Botnets are infrastructure for hire. The dominant use is distributed denial-of-service: directing thousands of devices to flood a target server until it collapses under the traffic. The Aisuru network drove an attack measured at 31.4 terabits per second in 2025. Credential stuffing runs stolen username-password pairs against banking and e-commerce sites at speeds impossible for a single machine — a technique behind many of the account takeovers that make headlines when platforms announce security incidents. Cryptomining conscripts processing power from thousands of devices without the operator paying electricity costs. Proxy rental is the most insidious use: the ASocks network rented 17 million infected IP addresses to paying clients who needed traffic that appeared to come from ordinary homes rather than datacenters.

Takedowns happen, and reconstruction follows within months. The economics are too favorable for the threat to diminish through enforcement alone. Recruiting a fresh device costs almost nothing — hundreds of millions of routers sit on the internet with default credentials and firmware that manufacturers stopped updating years ago. The most vulnerable devices are not corporate servers managed by IT teams. They are the cheapest hardware in the most homes, running unattended for the longest time.

Individual exposure is reducible. Changing the default login on any router or smart device before first use closes the most common entry point. Applying firmware updates when available removes the vulnerabilities botnet recruiter code was written to target. Disabling remote management features not in use cuts the device’s attack surface. DNS filtering services now incorporate machine-learning detection of DGA traffic patterns. None of this stops the operators already running the network. It removes one device from the pool of candidates for the next one.

Tags: Cybersecurity, malware, botnet, DDoS, IoT security, network security