Botnets Explained: Architecture, Attacks and Prevention

In March 2026, the U.S. Department of Justice teamed up with law enforcement in Germany and Canada to take down four botnets called Aisuru, KimWolf, JackSkid, and Mossad. Together, these networks had quietly hijacked more than three million devices and were behind over 300,000 DDoS attacks, with some traffic spikes topping 30 terabits per second.

That number shows where botnets stand today and the impact they can have if they go undetected. Today, they are scalable infrastructure that attackers can rent as a service. 

But the main question is: What is a botnet, and how can it cause such a widespread impact without being detected?

In this blog, we’ll explain how botnets work, how attackers build and control them, the impact they can have on organizations, and what you can do to detect and protect your systems from botnet activity.

What is a Botnet?

A botnet is a group of internet-connected devices such as servers, laptops, routers, IP cameras, even smart TVs, that have been quietly infected with malware and are now under an attacker’s remote control. That attacker usually goes by the name bot herder or botmaster, and each infected device becomes a bot.

The attacker doesn’t have to go after one big, high-value target. A botnet’s real strength comes from sheer numbers: thousands, sometimes millions, of everyday devices working together as a single weapon.

Bot vs. Botnet vs. Malware: What’s the Difference?

The terms bot, botnet, and malware are closely related, but they describe different things. 

A bot is a single device infected with malware that an attacker can control remotely. For example, one compromised router, laptop, or IP camera can act as a bot.

A botnet is the larger network created when an attacker controls many of these infected devices at the same time. The attacker can send commands to thousands or millions of bots and use them together to carry out attacks.

Malware is malicious software designed to compromise or perform unauthorized actions on a device. Botnet malware is what enables an attacker to control an infected device remotely.

Think of it this way:

• Bot: One compromised device.
• Botnet: A group of compromised devices controlled by the same attacker.
• Botmaster or bot-herder: The person who controls the botnet.
• C2 (Command and Control): The infrastructure used to communicate with and control the bots.

For example, if an attacker uses malware to compromise an IP camera, that camera can become a bot. When thousands of similarly compromised cameras are connected to the attacker’s control infrastructure, they form a botnet.

 The botnet can then be used for activities such as DDoS attacks, credential attacks, spam distribution, or proxying traffic.

In simple terms: Malware compromises the device, then the compromised device becomes a bot, and multiple bots together form a botnet.

Botnet Architecture: How These Networks Are Built

A botnet’s architecture determines how bots communicate, how commands are distributed, and how difficult the network is to disrupt. 

Centralized C2: In a centralized botnet, infected devices communicate with one or more central C2 servers. This setup is easy for attackers to manage, but the C2 servers can also be a weak point. If security teams disrupt these servers, they can affect the botnet’s operations. However, this does not automatically remove the malware from the infected devices. 

Peer-to-Peer (P2P): In a P2P botnet, bots can communicate with other bots instead of relying on a single central server. This removes a single point of failure and can make disruption more difficult. However, P2P architectures can also be more complex to manage. 

Hybrid Architectures: Some botnets combine centralized and decentralized techniques. For example, a botnet may use multiple C2 nodes or a P2P layer to make its infrastructure more resilient while still relying on specific systems for coordination.

Fast Flux: Fast Flux is not a separate botnet architecture. It is a technique used to make malicious infrastructure harder to block or take down. A domain can be associated with rapidly changing IP addresses, making it harder for defenders to rely on a single IP address as an indicator of compromise.

Domain Generation Algorithms (DGA):  DGA is a technique used by some malware to create domain names automatically. A bot can generate many possible domain names and try to connect to them until it finds an active C2 server. This activity can help security teams detect malware. For example, they may notice repeated requests for unusual or randomly generated domains, many failed DNS requests, or DNS activity that is different from the device’s normal behavior.

How Does a Botnet Work?

A botnet begins when attackers compromise internet-connected devices and establish a way to control them remotely. Once compromised, a device may connect to attacker-controlled infrastructure, receive instructions, and perform tasks alongside other infected devices.

The exact process varies between botnets, but the lifecycle generally includes device compromise, bot enrollment, persistence, command and control, task execution, and further recruitment.

Here’s how that happens, stage by stage:

Stage 1: Device Compromise: The attacker needs a way into the device first. That usually means exploiting an unpatched vulnerability, guessing weak or default passwords, tricking someone through phishing, or slipping malware in through a malicious download or an exposed service. Whatever the method, the end result is the same: botnet malware gets installed.

Stage 2: Bot enrollment: Once installed, the malware reaches out to the botnet’s command-and-control (C2) infrastructure. This is essentially the device introducing itself and getting registered as a bot, ready to take instructions from the botmaster.

Stage 3: Persistence: Many botnets don’t want to lose a bot just because the device restarts. So the malware often sets up ways to survive reboots and other interruptions, keeping itself active long-term (though exactly how depends on the device and the botnet’s design).

Stage 4: Command and control: From here on, it’s an ongoing relationship. The bot regularly communicates with the C2 infrastructure and keeps receiving new commands and, in some cases, reporting information back about the infected device. This back-and-forth can happen over normal-looking channels like HTTP/HTTPS or DNS, or through peer-to-peer connections, depending on the botnet’s setup.

Stage 5: Task Execution: Now the device actually gets used. Depending on what the attacker wants, it might be ordered to flood a target with traffic (DDoS), blast out spam, try stolen credentials against logins, scan for other vulnerable devices, relay traffic to hide the attacker’s tracks, or burn its processing power mining cryptocurrency.

Stage 6: Further Recruitment: Finally, some botnets turn their existing bots into recruiters that are used to scan the internet or local networks for more vulnerable devices. Each new device that gets compromised joins the botnet and the network keeps growing.

Mirai shows why securing internet-facing IoT devices is important: a device that appears insignificant on its own can become part of a much larger attack infrastructure when thousands or millions of similarly vulnerable devices are compromised.

Why Are Botnets Difficult to Detect?

A botnet does not always make a compromised device look obviously malicious. A device may continue performing its normal function while malware quietly communicates with an attacker-controlled system in the background.

Several factors can make botnet activity difficult to detect:

• Low-volume communication: Some malware communicates with C2 infrastructure periodically instead of generating large amounts of traffic.
•  Encrypted traffic: HTTPS and other encrypted protocols can hide the contents of C2 communication from simple network inspection.
• Changing infrastructure: Fast Flux, DGA, and other techniques can make C2 destinations change over time.
• Limited visibility: Many IoT devices have limited logging and monitoring capabilities compared with enterprise endpoints.
• Distributed activity: A botnet spreads activity across many devices, so no single device may generate enough traffic to immediately trigger an alert.
• Normal-looking behavior: A compromised device may continue its normal activities while performing malicious tasks in the background.

For this reason, botnet detection usually depends on combining multiple signals rather than looking for one specific indicator. Network traffic, DNS activity, endpoint behavior, authentication logs, and threat intelligence can all provide useful evidence.

Botnet Lifecycle and Relevant MITRE ATT&CK Tactics 

The botnet lifecycle we discussed earlier spans stages from initial recruitment to monetization. 

Each stage creates different opportunities for detection and defense, making the lifecycle useful for identifying where security controls can catch attacker activity as it unfolds.

Each tactic here maps to a category of control: initial access calls for vulnerability management and MFA, execution and persistence to EDR, C2 to network/DNS monitoring, and later stages to segmentation and monitoring at the perimeter 

Types of Botnet Attacks

Botnets support a range of attacks, from DDoS and credential stuffing to proxy abuse and cryptojacking. 

• DDoS attacks: The most visible use is flooding a target with traffic from thousands of distributed sources until it becomes unreachable. 2026’s Aisuru-family attacks demonstrated this at a scale (30+ Tbps) that dwarfs anything seen even two years ago.
• Credential stuffing and brute force: Bots test stolen username/password pairs against login portals at scale, distributing requests across thousands of IPs to evade rate-limiting.
• Spam and phishing distribution: Compromised devices can send large volumes of spam and phishing emails. Because the emails come from real residential IP addresses, they may be harder to detect and block. 
• Click fraud and ad fraud: Bots can generate fake ad clicks and impressions. Attackers may use this to waste a competitor’s advertising budget or make money through fraudulent affiliate activity. 
• Cryptomining (cryptojacking): Bots can secretly use the CPU or GPU power of infected devices to mine cryptocurrency for the attacker. 
• Residential proxy networks: Some botnets turn infected devices such as routers, smart TVs, and streaming devices into proxies. Criminals can then route their traffic through these devices to hide its real source. The NetNut disruption in mid-2026, coordinated by Google, the FBI, and Lumen, targeted this type of operation. 
• Ransomware staging and data exfiltration: Botnets can also give attackers an entry point into a network. That access may later be used to deploy ransomware, steal data, or carry out espionage.

These capabilities also make botnets valuable as criminal infrastructure. Instead of operating a botnet themselves, attackers can monetize access by renting its capacity to other threat actors. 

Botnet-as-a-Service: The Cybercrime Business Model

Botnets are no longer built and operated solely by the person who benefits from them; they’re rented.

 Underground markets sell DDoS capacity by the hour or by the attack, proxy access by the gigabyte, and spam infrastructure by the campaign. 

The Aisuru/KimWolf/JackSkid/Mossad operation is a clear example: the four botnets combined issued more than 316,000 DDoS attack commands as a paid service to criminal customers, extorting victims and generating attacks that cost some organizations tens of thousands of dollars each. 

This as-a-service economy is why botnet activity keeps increasing even as individual operators get arrested: the infrastructure and the customer base are decoupled. Taking down one operator’s servers removes supply, but demand and the underlying vulnerable device pool remain.

Recent law-enforcement and security-industry operations show both the scale of botnet infrastructure and the challenges involved in removing it. 

• March 2026 Aisuru, KimWolf, JackSkid, and Mossad: The U.S. Department of Justice and international partners disrupted infrastructure associated with four IoT botnets that had compromised more than three million devices and were linked to hundreds of thousands of DDoS attacks. Some attacks reached approximately 30 Tbps. 
• Residential proxy network disruptions: Security researchers and law-enforcement agencies have also targeted infrastructure that allows compromised consumer devices to be used as residential proxies. These operations show that compromised devices can remain useful to criminals even when they are not being used directly for DDoS attacks. 

The key takeaway: A takedown can disrupt the infrastructure controlling a botnet, but it does not automatically secure the vulnerable devices that were compromised. Unless those devices are patched, reset, replaced, or otherwise remediated, attackers may be able to recruit them into another network.

Why This Matters

The main lesson is not that botnets are being defeated. It is that botnet infrastructure can be taken down faster than vulnerable devices can be secured.

As long as IoT and consumer devices are shipped with weak security, unchanged default passwords, and unpatched vulnerabilities, attackers will continue to have a large pool of devices to recruit.

A takedown can remove the current command servers, but it does not fix the underlying devices. That is why botnet disruption is often temporary unless the vulnerabilities that allowed the devices to be compromised are also addressed.

How to Detect a Botnet Infection?

At enterprise scale, individual-device symptoms are often too inconsistent to provide reliable detection on their own. Network and endpoint telemetry provide stronger indicators of an active botnet infection: 

• Beaconing: Regular, low-and-slow outbound connections at fixed intervals to the same or rotating external destinations are the clearest fingerprint of an active C2 channel. NDR (network detection and response) tools are built specifically to surface this pattern against a traffic baseline.
• DNS anomalies: High-entropy, algorithmically generated domain lookups (DGA behavior), repeated NXDOMAIN responses, or a device suddenly querying dozens of unfamiliar domains in a short window.
• Unusual egress patterns: A device or server suddenly acting as a relay, where traffic volumes or destinations inconsistent with its normal role is a hallmark of proxy/relay botnets like the ones behind the NetNut takedowns.
• Practical tooling stack: Zeek or Suricata for network-layer detection and signature/anomaly matching, YARA rules for identifying known bot malware families on disk or in memory, an EDR platform for endpoint-level behavioral detection, and an NDR/XDR layer to correlate beaconing and DNS anomalies across the environment rather than relying on any single log source.
• Why signature-based AV alone fails: Signature-based antivirus can still detect known malware, but it may miss previously unseen, obfuscated, or rapidly changing threats. A layered approach that combines endpoint, network, DNS, and behavioral signals provides broader visibility. 

How to Remove a Botnet Infection

Removing a botnet infection requires more than deleting a malicious file. The device may have been compromised through a vulnerability or exposed credential, and other devices may also have been affected. Organizations should therefore isolate the affected system, determine how the compromise occurred, remediate the device, and investigate whether the infection spread.

A typical remediation process includes:

1. Isolate the infected device: Remove the device from the network or restrict its connectivity to prevent further communication with C2 infrastructure or other systems.
2. Identify the infection: Use EDR, antivirus, network telemetry, and security logs to identify the malware, suspicious processes, C2 connections, and potential persistence mechanisms.
3. Remove the malware: Follow the appropriate remediation procedure for the device. For critical or heavily compromised systems, rebuilding or reimaging the device may be safer than attempting to remove individual malicious components.
4. Patch the vulnerability: Determine how the device was compromised and apply the relevant security patches or configuration changes. For IoT devices, update firmware and replace devices that are no longer supported when necessary.
5. Reset compromised credentials: Change passwords or other credentials that may have been exposed, particularly default or reused credentials.
6. Check for additional infections: Investigate other devices for similar indicators, especially if the compromised system showed scanning, lateral movement, or botnet propagation behavior.
7. Monitor for reinfection: Continue monitoring DNS queries, outbound connections, C2 indicators, and unusual network activity after the device is restored.

For enterprise environments, remediation should also include determining how the infection occurred and whether other systems were affected. Simply removing the malware without addressing the vulnerability or compromised credentials can allow the device to become infected again.

How a Penetration Test Validates Botnet Resilience

Depending on the scope of the engagement, red teams and penetration testers can test whether an organization’s security controls can detect and contain botnet-like activity.

• C2 traffic testing: Testers simulate common botnet communication patterns, including DGA and fast flux traffic, within the target environment. This helps determine whether NDR and SIEM tools detect the activity or whether it gets lost in normal network traffic.
• IoT and network device testing: IoT devices, routers, and other network hardware are common targets for botnet recruitment. Testers can check these devices for default credentials, exposed management interfaces, and outdated firmware to identify the same weaknesses attackers could exploit.
• Egress and network segmentation testing: Testers simulate a compromised device trying to connect to an attacker’s C2 server or relay traffic. This shows whether network segmentation and outbound traffic controls can contain the device or allow it to communicate externally without being detected.
• DDoS resilience and rate limiting: Controlled load testing can show whether protections such as rate limiting, WAFs, and traffic scrubbing can handle distributed traffic similar to a botnet attack. This allows teams to find weaknesses before a real attack happens.
• Purple team testing with ATT&CK: Security teams can map these tests to relevant MITRE ATT&CK tactics such as Initial Access, Command and Control, and Persistence. This provides a clear view of which techniques the organization can detect and where gaps remain.

The goal is to move beyond simply understanding how botnets work and determine whether your security controls can actually detect and contain the behaviors associated with a botnet infection. 

Botnet Prevention Checklist for Enterprises

•  Maintain an accurate inventory of routers, IoT devices, servers, endpoints, and other internet-connected assets.
• Replace default credentials before deploying routers, IoT devices, and network appliances.
•  Keep operating systems, applications, and device firmware patched according to risk and defined remediation timelines. Replace devices that are no longer supported when security updates are unavailable.
• Restrict internet-facing management interfaces and expose only the services that are required.
• Monitor DNS and outbound network traffic for unusual domains, beaconing patterns, unexpected destinations, and abnormal traffic volumes.
• Segment IoT and OT devices from critical business systems so that a compromised device has limited access to the rest of the environment.
• Enforce MFA, particularly for privileged and high-value accounts, to reduce the impact of stolen credentials used in automated login attacks.
• Combine endpoint and network monitoring so that security teams can correlate suspicious processes, DNS activity, authentication events, and outbound connections.
•  Conduct regular penetration testing and red-team exercises to validate IoT hardening, network segmentation, C2 detection, and response controls.
• Maintain an incident response procedure for compromised devices that covers isolation, investigation, credential resets, patching or rebuilding, and monitoring for reinfection.

Conclusion

Botnets turn individual compromised devices into coordinated attack infrastructure. Their impact comes from scale, while techniques such as distributed C2, changing infrastructure, and low-volume communication can make them difficult to detect.

For security teams, preventing botnets is not only about blocking known malicious IP addresses or malware. It also requires strong device security, timely patching, network segmentation, DNS and egress monitoring, endpoint visibility, and a tested incident response process.

Knowing which controls should detect botnet activity is different from knowing whether those controls actually work in your environment. Controlled security testing can help identify those gaps before attackers exploit them.

SecureLayer7 can help organizations evaluate these controls through penetration testing and red-team assessments, including controlled C2 emulation, IoT and network-device testing, egress and segmentation testing, and security-control validation aligned with MITRE ATT&CK.

Talk to the SecureLayer7 security team to discuss your testing requirements.

Frequently Asked Questions (FAQs)