Demystifying Botnets: Understanding the Anatomy of a Cyber Threat | by Dwayne Wong (Omowale) | Jul, 2023

Botnets are networks of computers that are controlled by a central server. The computers in a botnet are called bots, and they can be infected with malware without the user’s knowledge. Once a bot is infected, it becomes part of the botnet and can be used for various malicious activities. The central server that controls the botnet is called the Command and Control (C&C) server. The C&C server sends instructions to the bots, which then carry out the commands.

Botnets are used for a variety of malicious purposes, including launching DDoS attacks, sending spam, spreading malware, and stealing sensitive information. DDoS attacks are one of the most common uses of botnets. In a DDoS attack, the bots in the botnet send a flood of traffic to a target server, which overwhelms the server and causes it to crash. This can result in significant downtime and financial losses for the victim.

Botnets work by infecting computers with malware, which then allows the central server to control the infected computers. The malware used to infect the computers can be delivered in various ways, including through email attachments, malicious websites, and software vulnerabilities. Once a computer is infected, it becomes a bot and can be controlled by the C&C server.

The C&C server sends instructions to the bots, which can include launching DDoS attacks, stealing sensitive information, or spreading malware. The bots receive their instructions through a command protocol, which can be encrypted to make it difficult to detect. The bots can also communicate with each other, which allows them to coordinate their attacks.

There are several types of botnets, each with its unique characteristics and methods of operation. Some of the most common types of botnets include:

IRC botnets are one of the oldest types of botnets and are still in use today. They use Internet Relay Chat (IRC) channels for communication between the bots and the C&C server. The bots connect to the IRC channel and wait for instructions from the C&C server.