What Is a Botnet and How It Works

A botnet is a set of hijacked devices that a criminal controls from a distance. The owners usually do not know their devices are part of it. The attacker can then use the whole group at once.

This guide explains what a botnet is, how it works, what botnets are used for, recent attacks and how to protect your devices. It follows NIST, CISA, Cloudflare and the US Justice Department. Sources were checked on October 22, 2026.

The short answer

A botnet is made up of hijacked internet-connected devices managed through command and control software. CISA says attackers often use them for distributed denial-of-service attacks, which flood a target with traffic.

The devices are victims too. Routers, cameras and TVs are common targets, according to the Justice Department and Cloudflare reporting. Keep devices updated and replace ones that no longer get updates.

Botnet meaning

NIST's glossary, quoting a security vendor, says the word botnet is formed from robot and network. Cybercriminals use trojans to take control of many computers and organize them into a network of bots.

CISA describes a botnet as a collection of internet-connected devices that attackers have hijacked. Attackers exploit security flaws or weak devices to control them through command and control software.

How a botnet works

This is a simplified picture built from the CISA and NIST descriptions.

CISA notes that the infected devices are victims too when a botnet attacks.

Botnets are used to

A botnet is a tool, so criminals use it in several ways. The sources I checked describe three.

Court documents also allege that some botnet operators sold access to cybercriminals, according to a report on a March 2026 US operation.

Botnet DDoS

CISA explains that a denial-of-service attack leaves legitimate users unable to reach a service, because the target is flooded with traffic until it cannot respond or crashes.

A DDoS attack does this from many machines at the same moment. This is our analysis: because the traffic comes from many ordinary-looking devices, blocking one address does not stop it.

Botnet attacks in numbers

Cloudflare reported that the total number of DDoS attacks more than doubled in 2025 to 47.1 million, an average of 5,376 mitigated every hour.

Its report covers a record 31.4 terabit-per-second attack that it attributed to the Aisuru-Kimwolf botnet in late 2025.

In its first-half 2026 report, Cloudflare said it mitigated 935 network-layer attacks above 1 terabit per second, 805 of them in the second quarter. That was a more than six-fold rise on the first quarter.

What devices get infected

The Justice Department described a botnet of more than 200,000 consumer devices that included small office and home routers, IP cameras, video recorders and network storage.

Reporting on the Aisuru-Kimwolf botnet says it captured over 2 million Android devices, most of them off-brand Android TVs. SecurityWeek earlier described Aisuru as powered by hacked routers and DVRs.

Botnet infection

An infected device often keeps working, so an owner may notice no obvious symptoms, though some infections cause slowdowns or odd traffic. That is our analysis, and it is why prevention matters more than spotting symptoms.

CISA points to security vulnerabilities and device weaknesses as the way in. Our reading is that devices which never get updates are the easiest to take over.

Law enforcement action

In March 2026, the Justice Department took part in a court-authorized operation to disrupt command and control infrastructure used by four IoT botnets: Aisuru, KimWolf, JackSkid and Mossad.

Canada and Germany acted at the same time against people who operated them.

Court documents said the botnets had infected more than three million devices as of March 2026. The operation disrupted the infrastructure that controlled those devices. It does not mean every infected device was cleaned.

Court records cited in that report allege that Aisuru sent over 200,000 DDoS attack commands. An earlier court-authorized operation sent disabling commands to a botnet of consumer devices without affecting their legitimate functions.

Botnet detection

Spotting a botnet attack from the target's side is a matter of watching traffic. CISA lists unusually slow network performance and unavailable services as possible symptoms of a DoS or DDoS attack.

CISA also advises organizations to sign up for a DoS protection service that spots abnormal traffic and diverts it away from the network. For home users, detection is mostly about keeping devices updated.

Slow internet alone does not show a botnet infection, because many things cause it. This is our analysis: router logs and alerts from your internet provider can give clues.

Botnet, DDoS and malware: how the terms fit

This is our explanation. Malware is the software, the botnet is the network of infected devices it creates, and DDoS is one attack that network can carry out. NIST's definition notes that botnets are often built with trojans.

So a botnet is not an attack on its own. It is the infrastructure that makes large attacks possible.

Our guide to the types of malware covers trojans, worms and how they connect to botnets.

If you think a device is infected

This is our advice. Disconnect a suspected device from the network. Follow the manufacturer's recovery instructions, install the latest firmware, and change its administrator and network passwords from a trusted device.

If the problem continues, or the device has stopped receiving security updates, replace it. For computers, run a trusted security scan, and for work equipment, contact IT before resetting anything.

How to protect your devices

CISA says no one can completely avoid being a target of DoS or DDoS attacks, but strengthening the security of all internet-connected devices helps prevent them from being compromised.

It advises installing and maintaining antivirus software and a firewall. In April 2026 the Justice Department also told router owners to replace end-of-life and end-of-support routers. This is our summary of that advice.

The botnet that used default passwords

In October 2016, a botnet called Mirai made headlines. CISA's alert on Mirai says the malware continuously scans the internet for vulnerable Internet of Things devices, infects them and uses them in attacks.

According to the alert, Mirai used a short list of 62 common default usernames and passwords to find devices it could take over.

The devices involved were primarily home routers, network-enabled cameras and digital video recorders. The alert also says its source code was published online, which opened the door to copies.

The lesson is simple. Nobody hacked each camera. The attackers tried the passwords that were printed in the manual. That is why changing a default password is more than a minor tip.

How a bot gets recruited and controlled

Most botnets follow the same life cycle. This five-step model is ours, and it fits many cases.

Some botnets use a central controller, which is easy to shut down once found.

Others let the infected devices pass instructions between themselves, which is harder to take down. That difference is why law enforcement operations often target the controller first.

What botnets are used for

The common uses are denial-of-service attacks, which overwhelm a site with traffic, and sending spam or phishing email. Others are credential stuffing, which tries stolen passwords on many sites, click fraud and mining cryptocurrency on other people's hardware.

Owners often rent out botnets. That means the person whose device is infected rarely sees the damage. The harm lands on the victims of the attack, and your device simply loses speed, bandwidth or privacy.

Signs a device may be part of a botnet

Many infected devices show no signs at all. These clues are possible, not proof, and they are our suggestions.

Secure your router and smart devices

CISA's alert says to change all default passwords to strong ones, because default usernames and passwords for most devices can easily be found on the internet. It also advises buying devices from companies with a reputation for providing secure ones.

This checklist is our advice, built on that guidance. It takes about ten minutes for a typical home.

Frequently asked questions

What is a botnet?

A network of hijacked internet-connected devices controlled remotely through command and control software.

How does a botnet work?

Malware infects devices, they connect to the attacker's control system and then carry out commands, such as flooding a target with traffic.

What are botnets used for?

DDoS attacks, hiding malicious traffic and stealing information, according to CISA and the Justice Department.

Could my phone or TV belong to a botnet?

Yes. Reports say the Aisuru-Kimwolf botnet infected more than 2 million Android devices, mostly off-brand TVs.

How can I tell if a device of mine is in a botnet?

Often you will not know. Keep devices updated and replace unsupported ones.

Can my smart TV or camera be part of a botnet?

Yes. CISA's alert on Mirai says infected devices were primarily home routers, network cameras and video recorders.

Who controls a botnet?

Its owner, through a command and control server or, in some designs, through the infected devices themselves.

Is changing the default password enough?

It is the single most important step, and it stops the attack Mirai used. Also update firmware and replace devices that no longer get updates.

A quick checklist

• Update routers, cameras and TVs.
• Replace unsupported devices.
• Use unique passwords.
• Turn off unused remote access.
• Run antivirus on computers.

Up nextTypes of malware explained with examplesBotnets are one kind of malware. Read our guide to types of malware explained with examples.→