Relay botnet

What a relay botnet is

A relay botnet is not just a collection of infected hosts, it is infrastructure. The devices are coordinated to pass traffic onward, hide where it really came from, or support criminal services such as proxying, relaying, and command-and-control paths. That makes the botnet useful even when it is not obviously blasting out spam or denial-of-service traffic.

Relay botnets matter because their value comes from concealment and persistence. Operators can route malicious traffic through ordinary-looking devices, which makes attribution harder and lets the network survive longer than louder botnet styles that are easier to notice and disrupt.

How relay botnets work

A relay botnet usually starts with compromised endpoints, IoT gear, routers, cloud workloads, or other exposed systems. Once enrolled, each node receives instructions to forward traffic, accept relayed connections, or pivot requests through additional hops. This distributed forwarding layer can be used for fraud, abuse, evasion, or to mask the real origin of criminal activity.

The key mechanism is trust abuse. A relay node may appear to be a normal device making routine outbound connections, but in practice it is acting as infrastructure for someone else. That blend of legitimate-looking device behaviour and covert function is what makes relay botnets difficult to distinguish from normal remote administration, proxy use, or update traffic.

Why relay botnets are hard to see

Relay botnets often avoid the obvious signs associated with noisy malware. Instead of generating one dramatic event, they can live inside a background of routine polling, encrypted sessions, short-lived connections, and distributed traffic patterns. Security teams may only see fragments of the chain unless they correlate device inventory, outbound destinations, and unusual forwarding behaviour across many hosts.

Detection becomes harder when the compromised devices are already expected to communicate externally, such as consumer routers, remote access appliances, or unmanaged IoT endpoints. In those environments, malicious relay traffic can look like ordinary internet use unless there is strong baseline visibility and logging.

For broader botnet patterns, including proxy and loader infrastructure, the Botnets Guide is the best starting point for understanding recruitment, takedowns, and detection signals.

How organisations reduce relay botnet exposure

Exposure usually comes from weakly managed devices, internet-facing management surfaces, outdated firmware, exposed credentials, or poor segmentation between user devices and systems that should never become forwarding infrastructure. Organisations reduce that exposure by keeping accurate asset inventory, limiting direct internet reachability, and watching for devices that begin acting like proxies or relays rather than endpoints.

Hardening matters because once a device is enrolled, the attacker may only need low-bandwidth access to keep using it. If the compromise is tied to exposed management interfaces or stolen secrets, the botnet node may remain useful long after the initial infection, especially when the operator can rotate tasks across many devices to evade shutdown.

Risk and Threat Considerations

Relay botnets create a dual risk: they hide attacker origin and they turn ordinary devices into reusable criminal infrastructure. That increases the chance of long-lived abuse, weak attribution, and repeat compromise of the same environment even after one infected host is cleaned up.

Failure mechanism: Attackers compromise devices with internet exposure or weak management protections, then use them as relays so malicious traffic appears to come from ordinary systems instead of the true operator.

Impact: Organisations can lose visibility into abuse, face reputational or legal exposure from traffic that appears to originate from their assets, and struggle to confirm that remediation has actually removed the operator's infrastructure.

Practitioner Guidance

Why practitioners should care: Treat relay botnet activity as both an endpoint problem and an infrastructure problem. A device that is merely “online” can still be serving as forwarding capacity for criminal operations, so the response has to look for traffic role changes, not just malware alerts.

What to watch for: Prioritise devices that show unusual outbound volume, unfamiliar proxy-like behaviour, repeated short sessions to rotating destinations, or management traffic patterns that do not match their normal function. If a device starts behaving like a relay, assume it is part of a wider campaign until proven otherwise.

Related resources from NHI Mgmt Group

• Who is accountable when a router becomes part of a global botnet or relay network?
• How should security teams reduce NTLM relay risk in Active Directory?
• When should organisations prioritise relay and coercion controls?
• Who is accountable when a management portal allows relay into certificate infrastructure?