A DDoS botnet is a network of compromised internet-connected devices that attackers coordinate to launch distributed denial-of-service (DDoS) attacks. Each infected device, called a bot, can send traffic or requests toward a target.
By acting together, bots can overwhelm a website, API, server, or network, preventing legitimate users from accessing the service. Botnets commonly include computers, routers, servers, and Internet of Things (IoT) devices.
How Does a DDoS Botnet Work?
A botnet-driven DDoS attack typically follows four stages:
1. Device compromise
Attackers exploit weak passwords, outdated software, or insecure configurations to infect devices with malware. Their owners may not know the devices are compromised.
2. Command and control (C2)
A bot herder sends instructions through C2 infrastructure. Some botnets rely on centralized servers, while others use peer-to-peer communication.
3. Coordinated traffic
Infected devices generate packets, network connections, or application requests against a selected target, often at the same time.
4. Service disruption
The resulting load can exhaust bandwidth, connection capacity, or application processing resources, causing latency, errors, or outages.
The attacker does not need to control the target directly. Instead, the coordinated traffic consumes resources the target needs to serve legitimate users.
DDoS Botnet vs. Botnet vs. DDoS Attack
These terms describe related but different concepts:
| Term | Meaning |
|---|---|
| Botnet | A network of compromised devices controlled by an attacker, potentially used for spam, fraud, or DDoS attacks. |
| DDoS botnet | A botnet coordinated specifically to generate DDoS attack traffic. |
| DDoS attack | An attempt to disrupt a service using traffic or requests from distributed sources. |
The distinction: A botnet is an attacker-controlled resource; DDoS describes an attack. Not every botnet conducts DDoS, and not every DDoS attack requires a malware-infected botnet. For example, reflection and amplification attacks can misuse legitimate third-party servers without infecting them. Learn more about bot networks.
What Types of DDoS Attacks Can Botnets Launch?
Botnets can generate different types of traffic to overwhelm different system resources:
| Attack Type | Example | Primary Impact |
|---|---|---|
| Volumetric | UDP flood | Saturates network bandwidth. |
| Protocol or state exhaustion | SYN flood | Consumes connection or network-device capacity. |
| Application layer | HTTP flood | Overloads websites, APIs, or backend services. |
Security teams may track bits per second (bps), packets per second (pps), and requests per second (RPS), depending on the attack. Read more about volumetric DDoS attacks and application-layer DDoS attacks, including HTTP floods.
Real-World DDoS Botnet Examples
Mirai and the 2016 Dyn incident. Mirai infected IoT devices, including internet-connected cameras and recorders. A Mirai-variant botnet was involved in October 2016 attacks that disrupted DNS provider Dyn and affected access to major websites. The U.S. Department of Justice documented the case.
Aisuru and KimWolf in 2026. On March 19, 2026, the U.S. Department of Justice announced an international operation disrupting C2 infrastructure used by Aisuru, KimWolf, and two other IoT botnets. Authorities reported that the four networks had collectively hijacked more than three million devices worldwide.
These incidents illustrate how compromised consumer and network devices can be used to disrupt critical online services.
How Can You Recognize a Botnet-Driven DDoS Attack?
Potential warning signs include:
- Traffic spikes: Sudden increases in bandwidth usage, packet rates, or HTTP requests.
- Repeated patterns: Similar requests or connection attempts across many source addresses.
- Targeted endpoints: Unusual pressure on login pages, APIs, or expensive application functions.
- Service degradation: Higher latency, connection failures, HTTP errors, or timeouts.
Compare these signals with normal traffic baselines and correlate request patterns with origin performance. A large number of source IP addresses can suggest distributed activity, but cannot, by itself, prove those devices are infected bots.
How Can Organizations Protect Against DDoS Botnet Attacks?
Botnet-driven DDoS attacks come from distributed sources and can shift tactics during an incident, so blocking individual IPs isn’t enough.
Organizations should combine four complementary defense measures:
-
Filter network floods upstream. Use DDoS scrubbing and upstream traffic filtering to absorb or block volumetric attacks before they saturate critical links.
-
Protect applications and APIs. Combine rate limiting, behavioral analysis, and applicable web application firewall (WAF) rules to mitigate malicious HTTP requests without unnecessarily blocking real users.
-
Manage abusive bots. Apply bot mitigation to detect and restrict harmful automated traffic. Network-layer and application-layer defenses address different threats.
-
Strengthen preparedness. Protect origin access, monitor traffic baselines, establish a DDoS response plan, and test mitigation controls. Separately, patch and secure connected devices to reduce botnet recruitment.
A WAF alone cannot stop every DDoS attack: a network flood may require upstream capacity and network-layer mitigation. CDNetworks Flood Shield 2.0 offers layered DDoS protection for websites, applications, APIs, and network infrastructure.
Frequently Asked Questions
Are all botnets used for DDoS attacks?
No. Botnets can also distribute spam, perform credential stuffing, steal data, or carry out other malicious automated tasks.
Can DDoS attacks occur without a botnet?
Yes. Reflection and amplification attacks can abuse legitimate third-party servers without infecting those servers with botnet malware.
Can a WAF stop a DDoS botnet attack?
A WAF can help filter applicable HTTP/S attacks. Large network floods also require upstream capacity and network-layer DDoS mitigation.
