Threats and Attacks · Malware and payloads

What is a botnet (a network of zombie devices)?

A botnet is a network of internet-connected devices (computers, servers and smart gadgets like cameras and routers) infected by malware and remotely controlled by a single operator, without the owners' knowledge. The criminal uses the combined power of these machines for denial-of-service attacks, spam, credential theft and cryptocurrency mining. Your device can be part of one and you would barely feel it.

Zamak TechnologiesUpdated on July 12, 2026

How a botnet forms and acts

A botnet is born from many infected devices that all obey the same command. The cycle has four stages.

Infection

The malware gets in through a phishing message, a malicious download, an unpatched flaw or a smart device left on its factory password, and turns the device into a “bot” with no visible sign.

Enrollment in command

The infected device connects to the criminal's command-and-control (C2) server and starts waiting for orders, like a soldier awaiting instructions.

Waiting in silence

The bot stays dormant, using few resources so as not to draw attention, sometimes for months, ready to act when the operator commands.

Mass action

On a single order, thousands of devices act together: they take down a site with a flood of traffic, blast spam, test stolen passwords or mine cryptocurrency with someone else's hardware.

Source: N-able Cyber Encyclopedia (definition, the stages and the uses of a botnet) and Cloudflare DDoS Threat Report 2025 (scale of modern botnets).

What botnets are used for

Denial-of-service attack (DDoS) The best-known use: thousands of bots flood a site or service with traffic at once, taking it offline. It is the botnet as a battering ram.
Spam and phishing at scale The network blasts millions of malicious emails from different machines, which makes blocking harder and hides the real origin.
Credential theft The bots test stolen passwords in bulk against many services (credential stuffing), exploiting anyone who reuses the same password in several places.
Cryptocurrency mining (cryptojacking) The network uses the processor of the infected devices to mine digital currency, turning someone else's electricity bill and hardware wear into profit for the criminal.
Disguise network and fraud The devices become relay points that mask the origin of other attacks and feed fraud, such as fake clicks on ads.

Why a botnet is a problem for your company

1 to 4M

devices a single botnet measured in 2025 came to hold (Cloudflare, DDoS Threat Report 2025)

~2%

of network-layer DDoS attacks still come from Mirai variants, almost 10 years after it emerged (Cloudflare, 2025)

$ 4.44M

the average global cost of a data breach (IBM, 2025)

A botnet threatens your company from two sides. On the first, it is the weapon: a single network measured in 2025 came to hold 1 to 4 million devices and launched traffic attacks that passed 29 terabits per second (Cloudflare, 2025), enough to take down the website and services of any company in its sights. On the second, your own device becomes an accomplice: an infected computer or camera works for the criminal, gets its address placed on block lists (which sends your legitimate emails to spam) and burns the electricity and computing power that you pay for. The old networks do not even fade away: almost 10 years on, about 2% of network-layer DDoS attacks still come from Mirai variants (Cloudflare, 2025), fueled by smart devices on factory passwords. With a breach costing an average of $ 4.44 million (IBM, 2025), being on either side of that bill gets expensive.

How to keep the company out of a botnet

Staying out of a botnet means closing the doors the bot enters through and cutting the line it receives orders on:

Update everything, including what does not look like a computerUnpatched flaws are the favorite way in. That goes for servers and workstations, but also for cameras, routers and other smart devices, often forgotten.
Change the factory passwordsSmart devices on default passwords are the fuel of modern botnets. Swapping them for a strong, unique password closes that path.
Behavior-based defense that spots the botAdvanced endpoint defense identifies the bot by its behavior, including the silent conversation with the command server, even when the malware is new.
Cut the command line with DNS filteringBlocking access to command-and-control domains stops the infected device from receiving orders, neutralizing the bot even once installed.
Continuous monitoringA security operations center that watches traffic spots the pattern of an enrolled device before it causes damage or stains the company's reputation.

In practice

The worst botnet is the one you do not notice: your device quietly takes orders and works for the criminal while everything looks normal. No crash will warn you, so the defense is to cut the line to the command server before your machine ever fires a shot.

How Zamak handles botnets

Zamak Technologies works to keep the company out of botnets on two fronts alongside your team: it makes devices far harder to recruit, with advanced endpoint defense, managed updates and DNS filtering that cuts the conversation with the command server, and it absorbs the attack when the company is the target of a botnet, with mitigation and continuous monitoring by a security operations center. A good starting point is the security maturity check, which shows in minutes where your company is most exposed. It is part of Cybersecurity in the Zamak Method.

Frequently asked questions about botnets

What is a botnet in simple words?

It is an army of infected devices (computers, servers and smart gadgets) that obey the same criminal remotely, without the owners knowing. The operator uses their combined power to attack at scale: take down sites, blast spam, steal passwords or mine cryptocurrency. Each machine becomes a “zombie” at the operator's service.

How does my device get into a botnet?

Through the same route as any malware: a phishing message, a malicious download, an unpatched flaw or, very common today, a smart device (camera, router, video recorder) left on its factory password. Once infected, the device connects to the criminal's server and starts waiting for orders.

How do I know if I am in a botnet?

Common signs are slowness and a fan running at full for no reason, an internet or electricity bill rising with no explanation, programs crashing and your address showing up on block lists (with legitimate emails landing in spam). But the bot is built to stay quiet, so the absence of signs does not rule out an infection.

Do smart devices get into botnets?

Yes, and they are the preferred target today. Cameras, routers and other connected devices usually ship with a factory password and no updates, which makes them easy to recruit. Famous botnets were built precisely from millions of these gadgets.

Are a botnet and DDoS the same thing?

No. The botnet is the army; the denial-of-service attack (DDoS) is one of the weapons it fires. The same botnet can, instead of taking down a site, send spam, test stolen passwords or mine cryptocurrency. DDoS is the most visible use, not the only one.

How do I get out of a botnet and protect myself?

Update systems and smart devices, change factory passwords, use behavior-based defense on devices and DNS filtering to cut the command line, and keep traffic under monitoring. In case of infection, isolating the device and cleaning it with expert support cuts the link to the operator.