Botnet

Each infected device in a botnet, called a bot or zombie, runs malware that waits for instructions from the attacker's command-and-control infrastructure. Individually, a home router or a single laptop is not very powerful. Together, thousands or millions of them can send enormous volumes of spam, flood a website until it goes offline, try stolen passwords from countless IP addresses, or hide the attacker's real location by relaying traffic.

Botnets are often rented out as a service, which is why the same infrastructure can appear in very different attacks.

Example

In 2016, the Mirai botnet infected hundreds of thousands of internet-connected cameras and routers that still used factory-default passwords. Its operators used it to launch some of the largest distributed denial-of-service (DDoS) attacks seen at the time, including one against the DNS provider Dyn that made major websites unreachable for hours.

Why it matters for a SOC analyst

You may meet botnets from both sides. Inbound, they are behind password spraying and credential stuffing from thousands of residential IP addresses, which makes blocking by IP nearly useless. Inside your network, a device that suddenly beacons to unknown hosts or sends large amounts of outbound traffic may have been recruited into one.