Botnets 

Share

Latest news on botnets, covering botnet attacks, DDoS attacks, Mirai, IoT botnets, C2 servers (command-and-control), botnet takedowns, zombie computers, Emotet, Gameover Zeus, Operation Endgame, malware infections, spam, click fraud and cryptomining botnets.

A botnet is a network of internet-connected devices infected with malware and controlled remotely to carry out coordinated attacks, usually without the owners knowing. Each infected device, or bot, takes orders from command-and-control servers run by the attacker. Most botnets are used for distributed denial-of-service (DDoS) attacks, but they can also steal data, deliver malware, send spam and commit click fraud.

Many modern botnets are built from poorly secured connected devices such as cameras, routers, video recorders and TV boxes. In October 2026 Anthropic warned that small AI models could soon copy themselves across smart-home devices and form botnets, a risk it described as still emerging. Police have also targeted the infrastructure behind botnets, and Operation Endgame in May 2024 took down more than 100 servers and led to four arrests.

Defence starts with the basics: changing default passwords, installing updates and switching off services that are not needed. Network operators can block botnet traffic by null-routing command servers, while DDoS protection services absorb floods of requests. Security researchers study botnet malware and publish technical details so that defenders can spot infected devices.

Police forces, Europol, Eurojust and private security firms now work together on botnet takedowns. Critics note that a takedown often disrupts rather than ends an operation: a successor to Gameover Zeus appeared within about two months of its 2014 shutdown. In 2021 German police used Emotet's own infrastructure to push a clean-up command, and the episode prompted debate about legal limits.

The Zeus family of banking trojans first appeared in 2007 and was used to build botnets, and the Gameover Zeus variant, which also spread CryptoLocker ransomware, was disrupted in 2014 by Operation Tovar. The Mirai botnet infected hundreds of thousands of cameras, recorders and routers, and was tied to the October 2016 attack on the DNS provider Dyn that disrupted sites such as Twitter and Netflix. Its authors pleaded guilty in the US in 2017, and because its source code was posted online, variants are still seen today.

Botnets can quietly turn everyday devices into weapons. Our NewsNow botnets news feed brings together the latest headlines on botnets, DDoS attacks, Mirai, IoT botnets, takedowns and malware from reliable sources worldwide, so you have a comprehensive, up-to-date view.