Botnet

What a botnet is and what it is used for

Each hijacked device is a bot, and the attacker steers all of them from a command-and-control system. CISA describes botnets as groups of hijacked devices controlled through command-and-control software, notes that the infected devices are victims too, and mentions that botnets may be rented out as attack-for-hire services. The best-known use is a DDoS attack, where thousands of real addresses make blocking by source address ineffective.

Other uses follow the same logic: a bot has a real address, bandwidth and a working network stack. Bots send spam, scan the internet for the next victims and relay traffic for others. In the Mēris case below, the investigators found a proxy service running on many of the attacking devices.

Recruitment is mostly mundane. CISA alert TA16-288A explains that Mirai tried 62 common default username and password pairs, which was enough to take over hundreds of thousands of devices that never changed them.

How to tell if your server has become a bot

A bot server tends to look busy in the wrong direction: outbound connections nobody planned, a process you do not recognise using CPU, or a new listening port. Check these on the host, with root so that -p can show the owning process:

sudo ss -tnp state established
sudo ss -tulpn
ps -eo user,pid,%cpu,etime,cmd --sort=-%cpu | head
ip -s link show

The first command lists live TCP connections with the process behind each one. Look for many connections to unfamiliar addresses on one port, or from a service that should not call out. The second lists listening sockets, so an unexpected listener stands out. The third ranks processes by CPU, and the fourth shows byte counters per interface: run it twice and compare, because transmit counters that climb while your site is quiet are a warning sign. None of these proves a compromise alone, so compare with a baseline and follow the log monitoring guide.

The Mēris botnet, routers and common mistakes

In September 2021 Qrator Labs and Yandex published a joint analysis of Mēris. Yandex saw a peak of about 21.8 million requests per second on 5 September 2021, which it called the largest recorded application-layer DDoS attack. The bots were mainly MikroTik routers running RouterOS, the traffic used HTTP pipelining, and source addresses were not spoofed. Yandex's estimate was about 250,000 infected devices.

The post did not confirm how the routers were infected, so treat any single explanation with care. Cloudflare's write-up points to CVE-2018-14847, a RouterOS flaw patched in 2018.

Two lessons: unspoofed bots can be blocked at the application layer, and a router is as recruitable as a server. A common mistake after a suspected infection is killing the process and moving on, which leaves the original way in open.

How botnets fit into your defence

You face a botnet in two roles: as a target, and as a possible recruit. As a target, put a CDN or reverse proxy in front of the site, keep the origin address private and add request limits, as the DDoS protection guide describes. The Cloudflare H1 2026 report breakdown puts the botnet-driven record attacks in context.

As a possible recruit, close the doors bots use. Apply updates promptly (patch management guide), follow the SSH hardening guide and ban repeated guessing with Fail2ban. Keep databases and Docker off the public internet (databases, Docker). CISA also advises changing default passwords and keeping firmware current. If your checks look wrong, switch to the breach response guide rather than cleaning up in place.

Related terms: DDoS attack, SYN flood, Application-layer attack, Brute-force attack, Firewall.