What is a botnet? What the FBI, CISA and the FTC say

What the FBI, CISA and the FTC say it is

The FBI’s Internet Crime Complaint Center defines a botnet as a network of hijacked computer devices used to carry out cyberattacks such as Distributed Denial of Service (DDoS) and Telephony Denial of Service (TDoS) attacks or other nefarious activities. It defines a DDoS attack as one that overwhelms servers with a high level of internet traffic originating from many different sources, making it impossible to mitigate at a single source, and notes that DDoS-for-hire services let any motivated actor conduct disruptive attacks regardless of experience. CISA, in a page dated 1 February 2021, says attackers often leverage a botnet, a group of hijacked internet-connected devices, to carry out large-scale attacks by controlling numerous devices through command and control software. It adds that botnets may be rented out to attack-for-hire services, which allow unskilled users to launch DDoS attacks.

The FTC explains it for consumers: when many hacked devices link together they make up a botnet, a network spammers use to send millions of emails at once. It says millions of computers, phones and internet-connected devices such as smart cameras or voice assistants are part of botnets, and that most spam is sent this way. That is the answer to what is a botnet in one line from each: hijacked devices, controlled together, used for attacks and spam.

Mirai in 2016, and routers in 2026

CISA’s alert on Mirai and other botnets, last revised on 17 October 2017, describes IoT botnets as networks of devices infected with self-propagating malware. On 20 September 2016 a security blog was targeted by a DDoS attack, one of the largest on record, exceeding 620 gigabits per second, created by an IoT botnet powered by Mirai. CISA says Mirai continuously scans the internet for vulnerable IoT devices and uses a short list of 62 common default usernames and passwords to scan for them; the devices affected were primarily home routers, network-enabled cameras and digital video recorders. Bashlite, another malware family, also infects through default usernames and passwords, and the publication of Mirai’s source code increased the risk of more botnets.

A CISA and UK NCSC advisory published on 23 April 2026 describes a shift: China-nexus actors moving from individually procured infrastructure to large-scale networks of compromised devices, which it calls covert networks. It says they mostly consist of compromised small office and home office routers but pull in any vulnerable device that can be exploited at scale. It names Raptor Train, which in 2024 infected more than 200,000 devices worldwide and was made up of thousands of routers and IoT devices such as web cameras and video recorders, firewalls and network-attached storage, and the KV Botnet. Malwarebytes tells the Mirai story too, with routers and security cameras and weak default passwords, and SentinelOne names GameOver Zeus as a botnet that stole money from enterprises through phishing emails.

How to tell, and what to do

The sources agree it is hard to tell. CISA says infection of IoT devices often goes unnoticed by users, and that an attacker could compromise hundreds of thousands of them without the owners’ knowledge. The FTC lists warning signs: a device that suddenly slows down, won’t shut down or restart, or won’t let you remove software. Fastly asks whether a device randomly began running slowly or became very hot without unusual use. CISA warns that the symptoms of a DoS attack can resemble non-malicious availability issues, and says the best detection is monitoring network traffic through a firewall or intrusion detection system.

The fixes are plain. The FTC says to keep your device’s security updated, change preset passwords because hackers know how to find default passwords easily, and detect and remove malware; it also mentions slowdowns, legal trouble if attacks are traced to you, and identity theft if hackers stole your personal information. CISA recommends installing a firewall. The FBI’s advice for an organization under attack is to quarantine or take offline affected hosts, reimage compromised hosts as soon as possible unless told to preserve them for forensics, reset exposed credentials and file a complaint. For the signs on any computer see how to tell if your computer has a virus.

Illegal, or not necessarily? Where the sources differ

Malwarebytes, which sells security software, says there is nothing inherently evil about a botnet: botnets can perform repetitive tasks and let an operator speed up work by using participants’ resources, and it points to crowdsourced scientific experiments as an example. It also says that operating one for malicious purposes is highly illegal and violates laws on unauthorised access, computer intrusion, data breaches and cybercrime in many jurisdictions. In the pages we read, the FBI, CISA and the FTC describe the devices as hijacked or hacked and give no legitimate use. The two positions are not in conflict about attacks; they differ about the word.

Vendors add the technical picture that the public pages leave out. Palo Alto Networks, Fastly and SentinelOne describe how the bots receive instructions: from a command and control server or, as Fastly and SentinelOne say of newer botnets, peer to peer, so that bots pass on commands without a central server. Palo Alto and SentinelOne call the infected devices zombies, SentinelOne and Malwarebytes call the operator a bot-herder, and SentinelOne says a bot-herder may sell or rent control of the botnet. None of the vendor pages we read says, as CISA does, that the infected devices are themselves victims of the attack, or names small office routers as the base of the 2026 covert networks. Several of these companies sell security products.