Skip to main content

Spotlight Article: Botnets

September - October 2026

 

 

Botnets: The Invisible Threat Hiding in Your Home or Business Network

When people think of a cyberattack, they often think of desktops, laptops or smartphones. However, cybercriminals also target a much wider range of internet-connected devices, including home routers, security cameras, smart speakers, smart TVs, printers and other Internet of Things (IoT) technology.

As homes and businesses become more reliant on technology, the number of potential targets continues to grow. A single vulnerable device can give attackers a foothold in the wider network, putting personal information, business operations and other devices at risk.

What makes this threat particularly concerning is that compromised devices often continue working normally, giving little indication that anything is wrong.

Cybercriminals can link compromised devices into a network known as a botnet. This allows an attacker to coordinate and control large numbers of devices simultaneously, using them to carry out attacks.

 

What is a botnet?

A botnet is a network of devices infected with malware and remotely controlled by cybercriminals.

Each compromised device, or bot, follows commands from a malicious operator known as a botmaster. These commands are typically relayed through a command-and-control (C2) server or a peer-to-peer (P2P) network of bots.

 

What are botnets used for?

  • Spam Email Campaigns
  • Distributed Denial of Service (DDoS) Attacks
  • Fake Traffic Generation
  • Spyware and Information Theft
  • Remote Desktop Protocol (RDP) Attacks
  • Cryptocurrency Mining

 

How devices become involved in a botnet

Before a device can become part of a botnet, it must first be compromised by an attacker. This process can occur without the owner's knowledge and may take only a few seconds once a vulnerable device is found online.

Many IoT devices are designed with affordability, convenience and ease of use in mind, while security features may be limited or overlooked. Inadequate security controls, insecure configuration or poor maintenance can leave devices vulnerable in several ways.

Weak or Default Credentials: Devices with default credentials are vulnerable if users leave those credentials unchanged. Changing them during initial setup helps address this risk. Weak or easily guessed passwords also make devices easier to compromise.

Unpatched Vulnerabilities: Infrequent, unavailable or unapplied firmware updates can leave devices exposed to attacks that exploit known vulnerabilities.

Exposed Interfaces: Some devices have web-based administration portals or remote management services accessible over the internet. If these services are poorly secured or exposed unnecessarily, attackers may attempt to gain control remotely.

Malware Infections: Devices can also become compromised through malicious software. This may occur when malware is installed directly onto the device, delivered through another compromised system on the network, or downloaded through a malicious application.

Pre-Installed Backdoor: In some cases, low-cost or poorly regulated IoT devices may leave the factory with botnet malware already installed, allowing attackers to control them once they connect to the internet.

Once compromised, a device typically connects to attacker-controlled infrastructure to receive commands alongside other infected devices in the botnet.

 

Common devices targeted

At Home:

  • Routers
  • Smart speakers
  • Smart TVs
  • Security cameras (including smart doorbells)
  • Network Attached Storage (NAS) devices

In a Business:

  • Servers
  • Workstations
  • Laptops
  • Network appliances
  • Security camera systems
  • Point-of-sale devices and payment terminals

Any internet-connected device can potentially become part of a botnet if it is compromised.

 

Signs of exposure

Unexplained activity: Unusually high processor, memory or storage activity, or fans running excessively without an obvious cause, may indicate a problem. Other signs include unexpected flashing lights or unscheduled device restarts.

Slow internet: Your connection is slower than usual and your router is under heavy load, even when you are not downloading, uploading or installing updates.

Unknown network connections: A device is attempting to connect to unfamiliar destinations or transmitting network traffic that does not match expected behaviour.

Slow reboots and shutdowns: Malware may cause a device to take longer than usual to restart or shut down.

Applications crashing: Software that previously ran smoothly becomes unreliable or starts crashing.

Alerts or complaints: Antivirus software may flag suspicious activity, or you may receive alerts about attempted logins. People you know may also report receiving spam or malicious emails from you.

 

Risks to businesses

A botnet infection can cause significant financial losses. Businesses may need to invest time and resources in investigating the incident, removing malicious software, restoring affected systems and strengthening security. If left unresolved, the infection may continue to cause service outages and disruption, reducing revenue and productivity.

Customers, business partners and other stakeholders expect organisations to maintain secure, reliable services. If a business device is used to facilitate cybercrime or attack other organisations, trust in the business can quickly suffer.

A compromised device can give an attacker a foothold in the network. From there, they may attempt to move laterally to other systems, steal sensitive information, deploy additional malware or maintain ongoing access. This increases the risk of further incidents, including ransomware attacks and personal data breaches.

 

How to stay protected

Public & businesses

Avoid buying devices with weak security: Choose devices with robust security features and enable multi-factor authentication (MFA) where available.

Use strong, unique passwords: Change default credentials during initial setup and use a strong, unique password for each device.

Keep software and firmware updated: Applying updates promptly helps protect devices against known exploits commonly used by cybercriminals.

Be cautious of emails and hyperlinks: Treat unexpected links and attachments with suspicion. Avoid opening suspicious attachments, following untrusted links or installing files from unknown sources to reduce the risk of infection.

Use reputable security software: Keep antivirus software up to date and run regular scans on supported devices to identify and remove potential threats.

Review connected devices: Regularly check the devices connected to your network. Unknown or unexpected devices may indicate unauthorised access.

Business-specific guidance

Maintain a comprehensive asset inventory: Keep an accurate inventory of all internet-connected devices to ensure they are monitored, managed, and updated correctly.

Implement strong access controls: Use strong passwords and MFA for administrative accounts and remote access services. In additional, apply the principle of least privilege so that users are limited to only the permissions required for their role.

Patch systems properly: Establish a process for regularly updating operating systems, applications, network appliances, and IoT devices to address newly discovered vulnerabilities.

Segment networks: Separate critical business systems from IoT devices, guest networks, and other less trusted environments. This limits the spread of malware through the network if a device becomes compromised.

Monitor network activity: Regularly review network traffic for unusual patterns, unexpected outbound connections or other suspicious activity that may indicate a device is participating in a botnet.

 

Summary

Botnets are networks of compromised devices controlled by cybercriminals. They can include computers and mobile phones, as well as routers, smart speakers, camera systems, printers and many other connected devices. Because infected devices often continue operating normally, owners may not realise they are being exploited.

Compromised devices can be used to distribute spam, carry out DDoS attacks, steal information and support other forms of cybercrime.

Weak or default passwords, unpatched vulnerabilities and malware infections can all lead to devices becoming part of a botnet. Strong, unique passwords, MFA where available and regular firmware updates help reduce this risk.

Proactive device management and good cyber hygiene are essential for both individuals and organisations to reduce the risk of devices becoming part of a botnet.