Botnets Guide: How They Grow, What They Do and How to Defend

A botnet turns thousands or millions of devices that someone else owns into one remotely controlled tool, and your routers, cameras, servers and staff laptops can be part of one without anyone noticing. Botnets power the largest DDoS attacks on record, hide espionage traffic behind ordinary home and office IP addresses, and sell residential proxy access for fraud and password spraying. This guide explains how botnets grow and are controlled at a concept level, where they show up in an organisation, what harm they do, and how to detect and prevent devices being recruited. It is written for security operations, network and infrastructure teams, and the managers who own device estates. It covers defence only: no malware internals or attacker procedures. Defending a service against an incoming flood is covered in the DDoS Protection Guide; this guide focuses on not becoming part of the problem.

Key takeaways

• Botnets recruit what is neglected. End-of-life routers, default passwords, exposed management interfaces and unpatched internet-facing services are the common entry points, as the FBI's KV and Raptor Train operations both showed.
• DDoS is only one use. Modern botnets are rented out as residential proxies, espionage relay networks, click-fraud engines and malware delivery platforms.
• Your network can be an exit node. Bandwidth-sharing apps, monetisation SDKs and preinstalled firmware on cheap devices enrol hosts into proxy networks that attackers then use against others, and sometimes against you.
• Outbound traffic tells the story. Egress filtering, DNS logging and flow analysis find bots far more reliably than endpoint agents, which most IoT devices cannot run.
• Takedowns are temporary. Law enforcement disruptions remove command servers, but a reboot or a new operator re-exposes the same vulnerable device unless it is patched or replaced.

How the attack works

A botnet has three parts: the infected devices (bots), the command and control (C2) infrastructure that tells them what to do, and the operator who either uses the network or rents it to others. ATT&CK models the acquisition side as resource development: T1583.005 Acquire Infrastructure: Botnet (renting or buying one) and T1584.005 Compromise Infrastructure: Botnet (building one by compromising third-party systems), with T1584.008 Network Devices covering compromised routers and similar kit.

Recruitment

• Weak and default credentials: devices shipped with known logins and exposed remote management are recruited at scale. The FBI-led Raptor Train advisory told owners to replace default passwords and disable unused services and ports.
• Known vulnerabilities in internet-facing devices: the Mirai operators, who pleaded guilty in December 2017, looked for known and previously unreported vulnerabilities to take control of cameras, routers and digital video recorders, reaching hundreds of thousands of devices at peak (DOJ).
• End-of-life equipment: the KV botnet used by Volt Typhoon was built mostly from Cisco and NetGear SOHO routers that no longer received security patches (DOJ, January 2024).
• Supply chain and bundling: BADBOX 2.0 devices arrived with malware preinstalled or picked it up from backdoored setup apps (FBI PSA, June 2025). The 911 S5 network spread through VPN programs and pay-per-install bundles of pirated software (DOJ, May 2024).
• Monetisation SDKs and bandwidth apps: Google's January 2026 action against the IPIDEA residential proxy network found proxy code embedded in apps through SDKs paid per download, plus apps that users installed knowingly to sell unused bandwidth.

Control

• Tiered C2: bots check in to intermediate servers rather than the operator directly. Raptor Train and IPIDEA both used tiered designs, which makes takedown harder.
• Resilient addressing: some families generate rendezvous domains algorithmically (T1568.002 Domain Generation Algorithms), so blocking one domain does not cut them off.
• Proxy chaining: operators route traffic through bots as T1090.002 External Proxy or T1090.003 Multi-hop Proxy, so the victim sees a domestic residential IP instead of the real source.

The Mirai lineage

Mirai's source code was posted on a criminal forum in autumn 2016 and variants followed (DOJ). Its descendants remain the template for IoT botnets: Raptor Train ran a Mirai variant called Nosedive (FBI advisory via Help Net Security, September 2024). The lesson for defenders is that a single published codebase keeps recruiting the same classes of poorly secured device for years.

Where it shows up

Older names such as Storm, Rustock, Cutwail, Grum and Srizbi belong to the spam botnet era of the 2000s and early 2010s. They matter historically, but the current risk sits with IoT, proxy and loader networks.

How organisations end up hosting bots

• Unmanaged edge kit: branch routers, remote-worker SOHO routers and forgotten VPN appliances that nobody patches. See the Edge Device Security Guide.
• Shadow IoT: cameras, smart TVs, streaming boxes and building systems plugged into the corporate network by facilities or staff. See the IoT Security Guide.
• Exposed cloud services: unauthenticated container APIs and test servers left on public IPs.
• Endpoint software: free VPNs, "earn from your bandwidth" apps and pirated software on staff or BYOD devices, the delivery routes seen in 911 S5 and IPIDEA.

Impact

• Being attacked: floods against your services (T1498 Network Denial of Service, T1499 Endpoint Denial of Service) and credential attacks from residential IPs that slip past geo and reputation blocks. Google reported residential proxies being used for password spraying (T1110.003) and SaaS access.
• Being the source: your IP ranges appear in abuse reports and blocklists, your ISP may notify or throttle you, and your bandwidth and devices serve criminals. Traffic from 911 S5 proxies was linked to about 560,000 fraudulent unemployment insurance claims with confirmed losses above $5.9 billion (DOJ).
• A foothold inside: proxy code can also accept inbound instructions, so an enrolled TV box or phone on a corporate network may become a point of compromise behind the firewall (Google research reported January 2026).
• Legal and reputational exposure: devices relaying state-sponsored intrusions or criminal traffic draw investigations and ISP or FBI notifications to the owner.

Detection

Most bots run on devices that cannot host an EDR agent, so detection relies on network telemetry. D3FEND calls the core technique Network Traffic Analysis. See the NDR Guide.

Metrics that show it is working

• Percentage of IoT and edge devices in the asset inventory with a known owner and firmware version.
• Number of end-of-life internet-facing devices still in service, trending to zero.
• Percentage of device segments with default-deny egress rules.
• Mean time from an abuse report or ISP notification to device isolation.
• Count of devices still using default or shared credentials.
• Number of unapproved proxy, bandwidth-sharing or free VPN apps found on managed endpoints.

Prevention and hardening

Phased approach

1. Inventory first: discover every internet-facing and IoT device, including remote-worker routers you fund. Map to NIST CSF 2.0 ID.AM-01 and SP 800-53 CM-8. See the Asset Inventory and CMDB Security Guide.
2. Remove the easy wins: change default credentials, disable Telnet, UPnP and WAN-side management, and close unused ports (CM-7 Least Functionality). Test on a pilot site before fleet-wide changes and keep the prior configuration exported for rollback.
3. Replace end-of-life kit: unsupported devices cannot be fixed (SA-22 Unsupported System Components, CSF PR.PS-02). Both the KV and Raptor Train advisories told owners to replace them; a reboot after an FBI clean-up leaves a still-vulnerable device.
4. Segment and restrict egress: put IoT on its own VLANs with allow-listed destinations (SC-7 Boundary Protection). Start in log-only mode for two to four weeks, build the allow list from observed traffic, then enforce, keeping a time-boxed exception path.
5. Control software: block bandwidth-sharing apps, unapproved VPN clients and unofficial app stores through MDM and application control; buy devices from vendors with a published update policy and Play Protect certification where Android is involved.
6. Patch continuously: prioritise internet-facing devices and anything in the CISA Known Exploited Vulnerabilities catalogue (SI-2 Flaw Remediation). See the Attack Surface Management Guide.
7. Monitor and respond: feed flow and DNS logs to the SOC (SI-4, CSF DE.CM-01) and write a playbook for ISP or law enforcement notifications: isolate, preserve logs, reflash or replace, rotate any credentials stored on the device.

Decision guidance

• Patch or replace: patch if the vendor still ships fixes and the device can be managed centrally; replace if it is end-of-life, has no update channel, or ships with hard-coded credentials.
• Small organisations: rely on a managed router with automatic updates, protective DNS and an ISP that reports abuse. Avoid consumer devices from unrecognisable brands.
• Large organisations: invest in NDR coverage of IoT segments, network access control that profiles devices, and procurement rules that require a support end date and secure defaults, in line with CISA's Secure by Design alert for SOHO manufacturers.
• Where identity fits: each managed device has its own credentials and, increasingly, certificates. Unique per-device credentials and certificate-based enrolment stop one leaked default password unlocking a whole fleet. See the Device and IoT Identity Guide.

Framework mapping

Lessons from incidents

• Exposed management APIs become botnet nodes: the Carbonato botnet spread across Docker hosts left exposed to the internet and hunted the AI API keys stored on them. Never expose container daemons without authentication.
• Clean-up without replacement does not last: the DOJ noted that the KV botnet remediation was reversed by a router restart, and urged owners to replace end-of-life routers.
• Takedowns migrate, they do not end: after the FBI took control of Raptor Train's infrastructure, the operators tried to move bots to new servers and launched a DDoS against the effort before abandoning it.
• Cheap devices can arrive infected: BADBOX 2.0 malware was preinstalled before purchase, so procurement is a security control.
• Free software has a price: 911 S5 grew through VPN programs and pay-per-install bundles of pirated software, turning ordinary home PCs into criminal infrastructure.

Practitioner checklist

• Inventory every internet-facing, IoT and remote-worker network device with owner, firmware and support end date.
• Replace end-of-life routers, cameras and NAS devices rather than relying on clean-up.
• Change all default credentials and disable WAN-side management, Telnet and UPnP.
• Place IoT on segmented networks with default-deny egress built from observed traffic.
• Log DNS and flows for every segment and alert on new external destinations from IoT.
• Block bandwidth-sharing apps, unapproved VPN clients and unofficial app stores on managed devices.
• Require a published update policy and secure defaults in device procurement.
• Monitor abuse feeds for your IP ranges and have a playbook for ISP and FBI notifications.
• Prioritise patching of internet-facing devices listed in the CISA KEV catalogue.

Standards and references

• US Department of Justice: U.S. Government Disrupts Botnet People's Republic of China Used to Conceal Hacking of Critical Infrastructure
• US Department of Justice: 911 S5 Botnet Dismantled and Its Administrator Arrested in Coordinated International Operation
• FBI IC3: Public Service Announcement I-060525-PSA on BADBOX 2.0
• CISA: Secure by Design Alert, Security Design Improvements for SOHO Device Manufacturers
• Europol: Largest ever operation against botnets hits dropper malware ecosystem
• MITRE ATT&CK: Compromise Infrastructure: Botnet
• NIST: SP 800-53 Rev. 5
• Help Net Security: FBI forced Flax Typhoon to abandon its botnet

Related NHI Mgmt Group resources: DDoS Protection Guide · IoT Security Guide · Malware Guide · Threat Hunting Guide