## Definition
A botnet (from “robot network”) is a network of computers infected with malware and controlled remotely by an attacker, often without the owners’ knowledge. Each infected computer is called a “bot” or “zombie,” and the network of bots can be used to launch coordinated attacks, send spam, steal data, mine cryptocurrency, or execute distributed denial-of-service (DDoS) attacks that overwhelm websites and services. Botnets are one of the most significant threats in cybersecurity: they can consist of millions of devices, operate across international borders, and generate enormous profits for the criminals who control them. The largest known botnets have included tens of millions of compromised devices.
## Why It Matters
Botnets matter because they represent the dark infrastructure of the internet. Every major internet outage, spam wave, and data breach has likely involved botnets at some stage. The Mirai botnet, which emerged in 2016, infected hundreds of thousands of Internet of Things (IoT) devices — smart cameras, routers, thermostats — and used them to launch massive DDoS attacks that took down Twitter, Netflix, and Reddit. The Emotet botnet, dismantled by international law enforcement in 2021, had infected over 1.6 million computers and was responsible for distributing ransomware and banking trojans. Botnets are not just a technical problem; they are an economic and political one. They enable fraud, espionage, and sabotage at a scale that individual hackers could never achieve alone.
## Example
The Mirai botnet (2016) was a watershed moment. Its creators — college students, not sophisticated criminals — wrote malware that scanned the internet for IoT devices with default passwords, infected them, and added them to the botnet. In September 2016, Mirai launched a DDoS attack against the website of journalist Brian Krebs, reaching 620 Gbps — one of the largest attacks ever recorded. In October, Mirai attacked Dyn, a major DNS provider, causing outages across the eastern United States. The source code for Mirai was eventually released online, spawning countless copycat botnets. The lesson: the internet’s infrastructure is fragile, and the devices we connect to it are often insecure by design.
## Internet Angle
Botnets are the internet’s shadow economy. They operate through command-and-control (C2) servers, encrypted communication channels, and cryptocurrency payments that are difficult to trace. The “botnet-as-a-service” model has emerged: criminals rent access to botnets for a fee, lowering the technical barrier for cybercrime. On the defensive side, security researchers and law enforcement agencies constantly monitor, infiltrate, and dismantle botnets — but new ones appear faster than old ones are taken down. The internet is, in part, a war between bot herders (the criminals who control botnets) and security professionals, with ordinary users caught in the middle. Your smart fridge might be part of a botnet right now, and you would never know.
## Related Terms
– **DDoS**: Distributed Denial of Service, the most common botnet attack
– **Malware**: The software that turns computers into bots
– **Zombie computer**: An infected device controlled by a botnet
– **Mirai**: The most famous IoT botnet
– **IoT**: Internet of Things, the devices most commonly infected by botnets
– **Cybersecurity**: The field dedicated to defending against botnets
Word count: ~460