Botnet
/ˈbɒt.nɛt/ · Noun · Security & Infosec · Origin: 2000
Definitions
Botnet is a network of compromised computers (called bots or zombies) that are remotely controlled by an attacker, known as a bot herder, typically through a command-and-control (C2) server. Devices are infected through malware distributed via phishing emails, drive-by downloads, or exploiting software vulnerabilities, often without the owner knowing their machine is compromised. Botnets can consist of thousands to millions of devices, including personal computers, IoT devices, routers, and servers. They are used for distributed denial-of-service (DDoS) attacks that overwhelm targets with traffic, sending spam email at massive scale, cryptocurrency mining, credential stuffing, and click fraud. Notable botnets include Mirai (which hijacked IoT devices), Storm, Conficker, and Emotet. Modern botnets use peer-to-peer communication rather than centralized servers to resist takedown efforts. Defending against botnet recruitment requires keeping systems patched, running security software, and monitoring network traffic for unusual patterns.
In plain English: A secret army of hijacked computers that a hacker controls remotely to attack websites or send spam, without the computer owners knowing.
Modern botnets like Mirai target IoT devices (cameras, routers, DVRs) because they often run default passwords and rarely receive security updates. The 2016 Mirai botnet took down major websites by marshaling hundreds of thousands of compromised IoT devices.
Example: 'The Mirai botnet proved that your insecure smart toaster could be conscripted into an army that takes down half the internet.'
Source: IoT / notable incident
Etymology
- 1999
- Early IRC bots are chained together for DDoS attacks; the portmanteau 'botnet' (robot + network) emerges in security discussions
- 2000
- The 'EarthLink Spammer' case brings botnets to legal attention — a single operator controlled thousands of machines for spam
- 2007
- The Storm botnet infects millions of PCs and becomes a case study in resilient, decentralized malware architecture
- 2016
- Mirai botnet source code is released, spawning a new era of IoT-based botnets
Origin Story
The Robot Army Built from Hijacked Computers
A botnet is a network of compromised computers (called 'bots' or 'zombies') controlled remotely by an attacker, typically without the owners' knowledge. The term combines 'robot' and 'network,' and the concept emerged in the late 1990s from IRC (Internet Relay Chat) culture, where early bots were benign programs that managed chat channels. The transition to malicious botnets began around 1999-2000 with tools like Sub7 and Pretty Park, which let attackers remotely control infected Windows machines. The first major botnet to gain widespread attention was GTbot, which used IRC channels as its command-and-control infrastructure. By the mid-2000s, botnets had become sophisticated criminal enterprises. The Storm botnet (2007) infected an estimated one million computers and was used for spam and distributed denial-of-service (DDoS) attacks. Conficker (2008) compromised seven million machines across government, military, and corporate networks. The Mirai botnet (2016) took a different approach, targeting IoT devices like cameras and routers, and famously brought down major websites including Twitter, Netflix, and Reddit by overwhelming the DNS provider Dyn. Modern botnets are used for spam distribution, cryptocurrency mining, credential stuffing, and DDoS-for-hire services.
Context: Evolved from benign IRC bots in the late 1990s into malicious networks of compromised computers by the early 2000s.
Fun fact: The Mirai botnet's source code was publicly released by its creator, a college student named Paras Jha, in an attempt to cover his tracks. The release instead spawned dozens of copycat botnets that continue to plague IoT devices today.