What Is a Botnet? How It Works, Examples and Defenses

What is a botnet? It is a network of computers, routers, cameras and other internet-connected devices that criminals have infected with malware and control remotely, usually without the owners noticing. Botnets power DDoS attacks, credential stuffing, spam and anonymous proxy services. This guide explains how botnets recruit and control devices, what they are used for, and what the Mirai, 911 S5 and Raptor Train cases teach. It then covers how to spot an infected device on a corporate network and how to keep your devices out of botnets.

What Is a Botnet?

A botnet is a group of internet-connected devices that have been compromised with malware and can be controlled remotely, as one unit, by an attacker. Each infected device is called a bot or zombie. The owner usually sees nothing wrong, because the device keeps working normally while it carries out the attacker's tasks in the background.

The FBI defines a botnet in a 2025 public service announcement as "a network of Internet-connected devices compromised by malware that can be controlled remotely without the owners' knowledge." MITRE ATT&CK describes the same thing from the attacker's side: adversaries either rent an existing botnet, for example from a booter or stresser service, or build their own by compromising third-party systems, then use it for large-scale phishing, DDoS attacks or to hide their infrastructure.

Key botnet terms

Any device with an internet connection and enough computing power can become a bot: Windows PCs, Android phones and TV boxes, home and small-office routers, firewalls, network storage, IP cameras and digital video recorders. Routers and IoT devices are especially attractive because they run all the time, are rarely monitored and often keep factory passwords or old firmware for years.

How a Botnet Works

Every botnet follows the same three-stage pattern. First, the operator recruits devices by infecting them. Second, each infected device connects back to the operator's control system and waits for instructions. Third, the operator uses the combined bandwidth, computing power and IP addresses of thousands or millions of devices, or rents that capacity out to other criminals.

How devices are recruited

Government advisories and court records show four recruitment routes again and again:

1. Default and weak passwords. Mirai, the botnet that set records in 2016, logged in to cameras, routers and video recorders using a list of just 62 common factory usernames and passwords, according to CISA's Mirai alert. Devices that still use those logins can be taken over in seconds.
2. Known vulnerabilities in edge devices. The Raptor Train botnet recruited routers, firewalls and network storage by exploiting known, published flaws, as described in the FBI, NSA and Cyber National Mission Force advisory. MITRE notes that end-of-life edge devices are commonly used for botnets, but the advisory found many compromised devices were still supported by their vendors. They simply had not been patched.
3. Trojanized software. The 911 S5 botnet hid its malware inside free VPN apps and pirated software. Installing the app quietly turned the computer into a proxy node, according to the FBI's 911 S5 guidance. The FBI's BADBOX 2.0 warning describes cheap TV streaming boxes and other IoT devices that were infected before purchase or during setup through apps from unofficial marketplaces.
4. Malicious email. Loader botnets such as Emotet and Qakbot spread through email attachments and links, then sold access to the infected machines to ransomware groups.

The first two routes explain why IoT and network devices dominate modern botnets. Our IoT hacking statistics show how large and exposed that device population is.

How botnets are controlled

Once a device is infected, it needs a way to receive orders. There are two broad models, and the difference matters mostly for how hard the botnet is to shut down.

Many botnets mix the two, and operators often add layers, such as management servers behind the control servers, to make seizures harder. The Raptor Train advisory, for example, describes a tier of management servers and a web application that let customers task infected devices. For defenders, the practical point is the same either way: an infected device has to talk to the outside world, and that traffic is where you catch it.

What Are Botnets Used For?

A botnet is infrastructure. Its value is that thousands of real devices on real internet connections can act at once, and that their traffic is hard to tell apart from normal users. That makes botnets useful for almost every large-scale attack.

DDoS. The best-known use. Botnets aim the traffic of many devices at one website, network or DNS service until it fails. Our guide to what a DDoS attack is explains the attack types and defenses, and our DDoS attack statistics track record sizes and trends.

Credential stuffing. Attackers take username and password pairs leaked from one breach and try them on other sites. MITRE tracks this as Credential Stuffing (T1110.004) and OWASP lists it as automated threat OAT-008. Botnets and residential proxies let attackers spread attempts across thousands of addresses so each one stays under per-IP limits. See our credential stuffing statistics for how common it is, and our guide to password spraying for the related low-and-slow technique.

Proxying and residential proxy networks. Instead of attacking anyone directly, the botnet rents out its bots' internet connections. Criminals route their traffic through a victim's home or office IP, so fraud checks see what looks like a normal customer. MITRE tracks this as Proxy (T1090). The 911 S5 case below shows how large this business became. Cryptomining on infected devices falls under Resource Hijacking (T1496).

Mirai: The Botnet That Changed IoT Security

Mirai is the clearest example of how a botnet works and why IoT devices became the main target.

How it spread. Mirai scanned the internet for cameras, routers and digital video recorders and tried a short list of 62 default usernames and passwords. Because so many devices still used factory logins, that list was enough to take over hundreds of thousands of them. CISA notes that Mirai lived in the device's memory, so a reboot removed it, but a device that still used the same password was reinfected quickly.

What it did. On September 20, 2016, a Mirai botnet hit the Krebs on Security website with an attack above 620 Gbps, one of the largest on record at the time. A separate Mirai attack on the French host OVH reached at least 1.1 Tbps later that month. In October 2016, an attack using IoT devices on a DNS provider made more than 80 websites unreachable, according to an FBI IC3 public service announcement.

Who built it. In December 2017 the Justice Department announced guilty pleas from three young men, Paras Jha, Josiah White and Dalton Norman, for creating and operating Mirai under the Computer Fraud and Abuse Act. Court records state that over 300,000 devices ultimately became part of the botnet, which the group used for attacks, extortion of hosting companies and paid rentals. Two of them also admitted running a second botnet of more than 100,000 devices, mostly home routers, for advertising click fraud.

Why it still matters. At the end of September 2016, Jha published Mirai's source code online. That turned one botnet into a malware family. The Raptor Train botnet that U.S. agencies exposed in 2024 was built on Mirai-family malware, and the record-setting IoT botnets disrupted by the Justice Department in 2026 followed the same playbook of mass IoT infection.

The lesson for organizations. Mirai did not need sophisticated exploits. It needed devices with factory passwords exposed to the internet. Nearly a decade later, that is still the first thing to check.

911 S5: The Residential Proxy Botnet

On May 29, 2024, the Justice Department announced that a court-authorized international operation had dismantled 911 S5, which FBI Director Christopher Wray called "likely the world's largest botnet ever."

According to the indictment, from 2014 through July 2022 the administrator, YunHe Wang, and others spread malware that compromised millions of residential Windows computers associated with more than 19 million unique IP addresses, including 613,841 in the United States. The malware came bundled with free VPN programs such as MaskVPN and DewVPN and with pirated software. Wang allegedly ran about 150 dedicated servers to control the infected computers and sold access to their IP addresses as a residential proxy service.

The harm came from the customers. The government estimates that 560,000 fraudulent unemployment insurance claims originated from compromised 911 S5 IP addresses, resulting in confirmed fraud losses of more than $5.9 billion. Wang allegedly received about $99 million from the service between 2018 and July 2022. He was arrested on May 24, 2024, and charged with computer fraud and with conspiracy to commit computer fraud, wire fraud and money laundering. Authorities seized assets worth about $30 million, 23 domains and more than 70 servers, including those behind the rebranded service Cloudrouter. The Treasury Department sanctioned Wang and two associates the day before the announcement. The charges are allegations until proven in court.

Why it matters to businesses. The victims were ordinary computers, many owned by individuals and businesses. The FBI's guidance specifically warns organizations with bring-your-own-device policies that employees' personal machines may have been connected to the botnet, and lists the VPN apps involved. A free VPN on an employee laptop is a botnet risk, not just a policy issue.

Raptor Train: A State-Linked IoT Botnet

On September 18, 2024, the FBI, NSA and U.S. Cyber Command's Cyber National Mission Force, with partners in Australia, Canada, New Zealand and the United Kingdom, published a joint advisory on a botnet run by Integrity Technology Group, a Beijing company the FBI links to the hacking group known as Flax Typhoon.

Key facts from the advisory:

• The botnet had been active since mid-2021 and held over 260,000 devices in June 2024, about 126,000 of them in the United States.
• Bots were small-office and home routers, firewalls, network storage, IP cameras, DVRs and other IoT devices, recruited by exploiting known vulnerabilities.
• The malware was a customized Mirai variant.
• The operator's database held over 1.2 million records of compromised devices, including more than 385,000 unique U.S. devices.
• The botnet could launch DDoS attacks and served as a proxy that concealed the operators' identity while they attacked targeted networks.

The same day, the Justice Department announced a court-authorized operation in which the FBI took control of the botnet's infrastructure and sent commands that disabled the malware on infected devices. During the operation, someone launched a DDoS attack against the infrastructure the FBI was using, which failed to stop the disruption. Lumen's Black Lotus Labs had first identified and named the botnet Raptor Train in July 2023. For the group behind it and its other campaigns, see our profile of Flax Typhoon and the Raptor Train botnet.

Why it matters to businesses. Raptor Train shows that botnets are not only a criminal nuisance. A state-linked group used ordinary routers and cameras, many of them in U.S. homes and offices, as cover for intrusions. The advisory's mitigations are a ready-made checklist for any organization, and they appear in the prevention section below.

Botnet Takedowns: What Law Enforcement Has Done

Takedowns have shifted from arresting individuals to seizing control infrastructure and cleaning infected devices directly.

Sources: Europol on Emotet, DOJ on Qakbot, Europol on Operation Endgame and DOJ on the 2026 IoT botnet action, plus the Mirai, 911 S5 and Raptor Train sources above.

One pattern stands out. Takedowns remove an operator, but they do not fix the devices. Mirai's code lived on after its authors pleaded guilty, and the 2026 botnets recruited the same kinds of devices. Your own devices stay vulnerable until you patch, reconfigure or replace them.

Signs Your Devices May Be Part of a Botnet

Botnet malware is built to stay quiet, so there is rarely one obvious symptom. Watch for combinations of these:

• Internet traffic you cannot explain, especially from devices that should be idle at night
• A router, camera or storage device running hot, slow or rebooting on its own
• Your public IP address appearing on spam or abuse blocklists, or other organizations reporting attacks from it
• Websites challenging your users with CAPTCHAs or blocks more often than usual
• New admin accounts, changed settings or unknown port forwarding on routers and firewalls
• Free VPN, proxy or "unlocked" streaming apps on company or employee devices
• TV boxes or IoT gadgets from unknown brands, or Android devices that are not Play Protect certified, which the FBI lists as BADBOX 2.0 indicators

The FBI stresses that one indicator alone does not prove compromise. Treat each one as a reason to look closer.

How to Detect a Botnet Infection on a Corporate Network

In a company, the most reliable way to find bots is to watch what devices send out, not only what comes in. An infected device must reach its operator, and most corporate devices have a small, predictable set of destinations.

Three practical points make detection work:

1. Know what you own. You cannot spot a misbehaving camera you do not know exists. An up-to-date inventory of routers, firewalls, VPN appliances, cameras and other IoT devices is the base of every other check. External attack surface management finds the internet-facing ones.
2. Log egress and DNS. Many networks log inbound traffic carefully and outbound traffic barely at all. Botnet traffic is outbound by definition.
3. Baseline per device type. The Raptor Train advisory advises organizations to define, monitor and prepare for abnormal traffic volumes, because botnet traffic can look like normal traffic at first. A camera that suddenly talks to hundreds of internet hosts is abnormal even if the volume is small.

What to do if you find an infected device

1. Isolate it. Move it off the network or into a quarantine segment so it cannot reach other systems or the internet.
2. Preserve evidence. Save logs, configuration and, for servers and PCs, forensic images before cleaning, in line with your incident response plan.
3. Clean and harden. For IoT devices, reboot to clear memory-resident malware, reset to factory settings, update the firmware and set a strong unique password before reconnecting. CISA's Mirai guidance warns that a rebooted device with the same password can be reinfected within minutes. Reimage PCs and servers.
4. Replace end-of-life equipment. If the vendor no longer ships updates, cleaning only buys time.
5. Look for follow-on activity. An infected router or VPN appliance can be the entry point for lateral movement into the rest of the network. Check what it could reach.
6. Report it. In the United States, report to the FBI at ic3.gov, especially if the device matches a published advisory.

How to Prevent Botnet Infections

The Raptor Train advisory, the 911 S5 guidance and CISA's Mirai alert recommend largely the same controls. The checklist below combines them, with a way to verify each one.

For patch priorities, start with the flaws in CISA's Known Exploited Vulnerabilities catalog, because those are the ones attackers already use, including to recruit edge devices into botnets.

Buying decisions matter too. The FBI's BADBOX 2.0 warning shows that some cheap devices arrive already infected. Buy network and IoT equipment from vendors that publish security updates, and avoid devices that need apps from unofficial stores.

For customer-facing logins, assume some of the traffic comes from botnets and residential proxies. Blocking by IP address alone fails when attackers have millions of clean residential IPs, so combine MFA, breached-password checks and behavioral bot detection.

How Testing Validates Your Botnet Defenses

Most botnet-prevention controls are configuration claims: "IoT is segmented", "no default passwords", "edge devices are patched." Testing turns those claims into evidence. An authorized assessment should show:

• Which internet-facing routers, firewalls, VPN appliances and cameras exist, and whether any expose management interfaces or known vulnerabilities
• Whether any device accepts default or weak credentials
• Whether an IoT or guest segment can reach servers, user networks or the internet beyond what it needs
• Whether a compromised device could be used as a pivot point into the rest of the network
• Whether your monitoring raises an alert when a device starts behaving like a bot, which a controlled purple team exercise can check safely

An external and internal network penetration test covers most of this list, and a network penetration test is the usual place to start. Testing is done only on systems you own or are authorized to test, without real malware, and without touching third-party devices.

Frequently Asked Questions

How do I know if my computer is part of a botnet?

Look for unexplained network activity, a slow or hot device, unknown programs such as free VPN apps, and your IP address appearing on blocklists. Run a reputable anti-malware scan and check the FBI's published guidance for named botnets such as 911 S5. In a company, egress and DNS logs are more reliable than symptoms on the device.

Are botnets illegal?

Yes. Infecting devices without permission, running a botnet and renting one are crimes in the United States under the Computer Fraud and Abuse Act and in most other countries. The Mirai creators pleaded guilty to conspiracy charges, and the alleged 911 S5 administrator faces up to 65 years in prison if convicted on all counts.

What is the largest botnet ever?

There is no single agreed measure. The FBI called 911 S5, with more than 19 million IP addresses, "likely the world's largest botnet ever" when it was dismantled in May 2024. For DDoS power, the IoT botnets disrupted in March 2026 were behind record-breaking attacks.

Can a phone or smart TV be part of a botnet?

Yes. Android phones, TV streaming boxes, smart TVs, cameras and routers can all be infected. The FBI's BADBOX 2.0 warning describes millions of infected IoT devices, many of them cheap TV boxes that were compromised before they were sold.

Does restarting a router remove botnet malware?

Sometimes, briefly. Mirai-style malware runs in memory, so a reboot clears it, but the device is reinfected quickly if it keeps the same password or vulnerability. Reboot, reset, update the firmware and change the password, or replace the router if it is no longer supported.

What is a bot herder?

A bot herder is the person or group that controls a botnet. They manage the command-and-control infrastructure, add new devices and either use the botnet themselves or rent it out to other criminals.

What is the difference between a botnet and a DDoS attack?

A botnet is the network of infected devices. A DDoS attack is one thing a botnet can do with them: flood a target with traffic. Botnets are also used for credential stuffing, spam, fraud and proxying.

Next Step: Find the Devices Before Attackers Do

Every botnet in this guide grew by finding devices someone forgot: a camera with a factory password, a router that missed a firmware update, a free VPN on a laptop. The defense is concrete. Know what you have, fix what is exposed, segment what you cannot fix, and watch what leaves your network.

DeepStrike's penetration testing services cover infrastructure, cloud and red team engagements carried out manually, with clear reports and actionable fix recommendations. A network test can show which of your devices could be recruited into a botnet and whether your monitoring would notice. To discuss scope, contact DeepStrike.

About The Author

Mohammed Khalil is a Cybersecurity Architect at DeepStrike, specializing in advanced penetration testing and offensive security operations. With certifications including CISSP, OSCP, and OSWE, he has led numerous red team engagements, focusing on cloud security, application vulnerabilities, and adversary emulation. His work involves dissecting complex attack chains and developing resilient defense strategies for clients in the finance, healthcare, and technology sectors.

Sources and References

FBI IC3: Home Internet Connected Devices Facilitate Criminal Activity (BADBOX 2.0), June 5, 2025

FBI IC3: Guidance on the 911 S5 Residential Proxy Service, May 29, 2024

U.S. Department of Justice: 911 S5 Botnet Dismantled and Its Administrator Arrested in Coordinated International Operation, May 29, 2024

FBI, CNMF and NSA: People's Republic of China-Linked Actors Compromise Routers and IoT Devices for Botnet Operations, September 18, 2024

U.S. Department of Justice: Court-Authorized Operation Disrupts Worldwide Botnet Used by People's Republic of China State-Sponsored Hackers, September 18, 2024

CISA: Heightened DDoS Threat Posed by Mirai and Other Botnets

U.S. Department of Justice: Charges and Guilty Pleas in Three Computer Crime Cases Involving Significant DDoS Attacks, December 13, 2017

FBI IC3: Booter and Stresser Services Increase the Scale and Frequency of DDoS Attacks, October 17, 2017

U.S. Department of Justice: Qakbot Malware Disrupted in International Cyber Takedown, August 29, 2023

Europol: World's most dangerous malware EMOTET disrupted through global action, January 27, 2021

Europol: Largest ever operation against botnets hits dropper malware ecosystem, May 30, 2024

U.S. Department of Justice: Authorities disrupt world's largest IoT DDoS botnets, March 19, 2026

MITRE ATT&CK: Acquire Infrastructure: Botnet (T1583.005)

MITRE ATT&CK: Compromise Infrastructure: Botnet (T1584.005)

MITRE ATT&CK: Brute Force: Credential Stuffing (T1110.004)

MITRE ATT&CK: Proxy (T1090)

MITRE ATT&CK: Resource Hijacking (T1496)

OWASP: OAT-008 Credential Stuffing

CISA: Known Exploited Vulnerabilities Catalog