What is a botnet in simple terms?

A large group of infected computers and internet-connected devices that all take orders from one attacker, used together for things that need scale, such as denial-of-service attacks, spam or credential stuffing.

How do I know if my computer is part of a botnet?

Device symptoms are vague. The reliable signals are network-side: regular outbound connections to unfamiliar addresses, bursts of random-looking DNS queries, activity at times nobody is working, or your addresses appearing on mail blocklists.

What are botnets used for?

Distributed denial-of-service attacks, spam, credential stuffing, click fraud, residential proxy services and crypto mining. Almost all of it depends on having many machines rather than powerful ones.

Can a phone or a camera be part of a botnet?

Yes. Cameras, routers, NAS units and other internet-connected devices are prime targets because they are rarely patched, often keep default credentials, and nobody is watching them.

How do you remove a botnet infection?

Isolate the device, preserve evidence, then rebuild it from known-good media rather than cleaning it, and close the vulnerability or credential that allowed the infection in the first place.

IT explained · 7 min read

What is a botnet? How machines get recruited and how to spot one

Name: 247connect
Brand: 247connect

Written for: IT staff and business owners who want to understand the threat concretely and know which signals to look for in their own estate.

Command and control

A botnet is many compromised machines taking orders from one controller. The infected device usually keeps working normally, which is why it goes unnoticed.

In short

A botnet is a collection of compromised computers, servers and internet-connected devices that take instructions from a single operator. The infected machine usually keeps working normally, which is exactly the point: the operator wants the capacity, not the machine, so nothing obvious breaks. Botnets power denial-of-service attacks, spam, credential stuffing, proxy services and crypto mining.

Key takeaways

A botnet is many compromised devices under one command-and-control operator, rented out or used at scale.
Infected machines usually behave normally, because a broken device gets fixed and stops being useful.
Unpatched internet-facing devices and default credentials on cameras, routers and NAS units are the classic recruitment route.
The most reliable signals are network-side: odd outbound connections, DNS queries to nothing you recognise, traffic at 3am.
Removal means rebuilding and closing the original route in. Cleaning the visible payload alone leaves the door open.

What a botnet is, and what it is for

A botnet is a fleet of compromised devices that check in with a controller and do what it says. The devices are called bots or zombies; the controller is command and control, usually shortened to C2. Scale is the product: one machine is useless to the operator, fifty thousand is a commercial asset that can be rented by the hour.

The typical uses are all volume businesses. Distributed denial-of-service attacks need many sources. Credential stuffing needs many addresses to avoid rate limits. Spam needs sending capacity that has not yet been blocklisted. Residential proxy services resell the bandwidth of infected home connections. Crypto mining monetises spare processing quietly.

How devices get recruited

Not through anything exotic. Botnet operators run automated scans across the internet looking for known weaknesses, and take whatever answers.

Default or weak credentials on internet-exposed devices: routers, cameras, NAS units, printers, building controls.
Unpatched vulnerabilities in internet-facing services, exploited within days of disclosure.
Malware delivered by phishing or a pirated download, which then installs a loader.
Compromised software supply chains, including malicious browser extensions and packages.
Lateral movement inside an estate after one machine falls, using stored credentials.

Why nobody notices

A well-run botnet is quiet by design. The operator throttles activity so the user does not complain, keeps the payload small, and often uses the machine only outside working hours. Modern families use encrypted channels that look like ordinary web traffic, generate their C2 domain names algorithmically so blocklists go stale, and fall back to peer-to-peer coordination if the primary controller is taken down.

Purpose-built devices are worse. A camera or a NAS has no anti-malware, no user watching it, and often no patching process at all, so an infection there can persist for years.

Signals worth watching

The device-side symptoms are vague — a machine running warm, fans spinning at idle, sluggish performance. The network-side signals are much better, because a bot has to talk to its controller.

Outbound connections to addresses and countries with no business reason
DNS queries for large numbers of random-looking domains
Regular outbound activity on a fixed interval, which is a beacon
Traffic from devices that should be near-silent, such as cameras or printers
Mail rejections or blocklist entries for your address range
Sustained processor load at times nobody is working

Reducing the odds

The defences are the ordinary ones, applied to the devices people forget. Change default credentials on everything, including the equipment nobody thinks of as a computer. Keep internet-facing services patched, and question whether they need to face the internet at all. Segment purpose-built devices away from the machines holding data. Watch outbound traffic, not just inbound.

If a machine is confirmed as part of a botnet, rebuild it rather than cleaning it, and close the route that let it in. Loaders exist to install other things, so what you can see is rarely everything that arrived.

Common mistakes

Focusing entirely on inbound filtering while outbound C2 traffic leaves unexamined.
Excluding cameras, printers, NAS units and building systems from patching because they are not computers.
Removing the visible malware without closing the vulnerability or credential that allowed it in.
Assuming a device is clean because anti-malware reports nothing. Purpose-built devices cannot run it at all.

Frequently asked questions

What is a botnet in simple terms?: A large group of infected computers and internet-connected devices that all take orders from one attacker, used together for things that need scale, such as denial-of-service attacks, spam or credential stuffing.
How do I know if my computer is part of a botnet?: Device symptoms are vague. The reliable signals are network-side: regular outbound connections to unfamiliar addresses, bursts of random-looking DNS queries, activity at times nobody is working, or your addresses appearing on mail blocklists.
What are botnets used for?: Distributed denial-of-service attacks, spam, credential stuffing, click fraud, residential proxy services and crypto mining. Almost all of it depends on having many machines rather than powerful ones.
Can a phone or a camera be part of a botnet?: Yes. Cameras, routers, NAS units and other internet-connected devices are prime targets because they are rarely patched, often keep default credentials, and nobody is watching them.
How do you remove a botnet infection?: Isolate the device, preserve evidence, then rebuild it from known-good media rather than cleaning it, and close the vulnerability or credential that allowed the infection in the first place.

How this works in 247connect

Botnets recruit the devices nobody is looking at. Managed access with 247connect means the machines in the corner, in the warehouse and in people's homes are visible and reachable in around eight seconds, rather than only when something breaks.

Start a 14-day free trial See the feature list