What is a botnet — and why your router may already be in one

Twitter, Netflix, Spotify, Reddit, and PayPal all went dark on the same afternoon — not because of any failure at their own data centers, but because tens of thousands of home routers, cameras, and baby monitors had spent two hours flooding a single DNS provider with 1.2 terabits of traffic per second. The owners of those devices had no idea any of it was happening.

The attack was the work of Mirai, a piece of malware that had quietly recruited roughly 600,000 internet-connected devices by scanning for gadgets protected only by factory-default passwords. The word “botnet” combines “bot” (short for software robot) and “network.” Every infected device is called a zombie: it continues to function normally for its owner while silently executing orders from a remote criminal operator.

How devices get recruited

Botnets grow through several infection paths. Phishing emails carry malicious attachments that install malware when opened. Unpatched software exposes known vulnerabilities that automated scanners sweep the internet to find. Drive-by downloads compromise devices when a user visits a page rigged with exploit code.

The fastest-growing path is simpler: default credentials. Routers, cameras, smart televisions, and network storage drives routinely ship with identical passwords — “admin/admin,” “admin/password” — that millions of users never change. Mirai required nothing more sophisticated than a list of 61 default credential pairs and access to open Telnet ports.

The command infrastructure

Once infected, a device joins a command-and-control network that lets the operator issue instructions to thousands or millions of machines at once. The simplest architecture uses a central server: efficient, but a single point of failure that law enforcement can shut down. Sophisticated botnets use peer-to-peer models where bots relay instructions to each other, with no single chokepoint. Others rotate their server addresses every few minutes — a technique called fast-flux DNS — to outrun blocklists.

State-sponsored operations take a different approach. Volt Typhoon, a Chinese intelligence-linked group targeting US critical infrastructure, has avoided malware entirely since at least 2021, operating through legitimate system tools and compromised routers that sit undetected for months at a time.

What the network actually does

A botnet’s revenue model is diverse. DDoS-as-a-service is the most visible product: renting attack capacity to clients who want a competitor’s website or a government service knocked offline. Spam campaigns route billions of phishing emails through infected infrastructure, cycling through IPs constantly to avoid blocklists. Credential stuffing uses botnet nodes to test stolen login pairs across thousands of services simultaneously, spreading attempts thinly enough to avoid rate limits.

Cryptomining hijacks idle device CPU and GPU cycles to generate privacy coins. Click fraud simulates advertising engagement at scale. The proxy service model may be the most profitable of all: renting infected IPs as residential proxies to clients who need traffic that appears to originate from real homes rather than datacenters. The 911 S5 network, dismantled by US authorities in May 2024, ran 28 million compromised IP addresses as for-hire infrastructure for over a decade, generating an estimated $150 million before federal indictments were unsealed.

The cases that defined the threat

Mirai set the modern benchmark for scale and consequence. Its attack on DNS provider Dyn disrupted more internet services in a single afternoon than any previous event. Its creators then released the source code publicly, seeding dozens of successor botnets that remain active today.

Emotet ran from 2014 as a banking trojan and evolved into a botnet-as-a-service platform rented by other criminal groups. At its peak it had infected some four million devices across 180 countries. A coordinated takedown by agencies from nine countries disrupted it in January 2021. It rebuilt through access sold by the TrickBot gang and resumed operations twelve months later.

Among the most consequential recent cases: a residential proxy network that secretly turned 17 million devices into for-hire criminal infrastructure before its operators were arrested.

How to tell if your device is infected

Most compromised devices give no dramatic signals. Consistent high bandwidth usage when the device should be idle, unexpected CPU activity, connections to unfamiliar IPs visible in the router’s traffic logs, or notifications from your internet service provider flagging unusual outbound traffic can all indicate compromise. Some ISPs actively notify customers when a device on their line appears on botnet blocklists.

Reducing your exposure

The single most effective step is changing factory-default passwords on every networked device before connecting it: routers, cameras, printers, network-attached storage drives. After that: keep firmware updated on all devices, disable Universal Plug and Play (UPnP) on your router unless you actively use it, and put IoT devices on a separate network segment away from computers holding sensitive data.

Network monitoring software can flag anomalous outbound connections before they appear on an ISP alert. The tools exist. The update prompts appear. Botnets are large because most people dismiss both.

Tags: Cybersecurity, malware, botnet, DDoS, IoT security, Mirai