In this lesson,
we're going to explore botnets and zombies.
Now, a botnet is a network of compromised computers
or devices controlled remotely by malicious actors
and they're often used
for cyber attacks or other malicious activities.
A botnet is created by using other types of malware
to gain access to a system, victimize it,
and then add it to the botnet
so the attacker who controls the botnet
can use the processing, memory, storage,
or networking capabilities of your system
without your consent.
Now each botnet is made up of hundreds, thousands,
or even millions of compromised systems
which we call zombies.
Now, a zombie is simply the name
of a compromised computer or device
that is part of a botnet
and used to perform tasks using remote commands
from the attacker without the user's knowledge.
So what happens to your computer
if it becomes the victim of a botnet?
Well, let's pretend that your computer
picked up some kind of malware and that malware was designed
to change your computer into a zombie.
Your single workstation,
which is now considered to be a zombie,
is then added to the larger botnet
as part of a collection of compromised computers
under the control of a master node.
If your computer is now a zombie,
your system will now be under the control of the attacker
and that attacker can use a command and control node,
known as a C2 node, to control all the zombies
inside of their specific botnet.
Now, by sending commands to their C2 node,
the attacker can tell the zombies
to perform lots of different things,
including using zombies as pivot points
so they can get access to a new victim,
or if they're attacking a server,
they can actually access it through your computer
to make it look like you're the one doing the attack
or the hack instead of the actual attacker
who sent the command through their master C2 node.
Other attacks will try to create large botnets
so they can store illegal content
across a large number of devices.
For example, if somebody wants to host child pornography,
but they're afraid of getting caught with it,
they can store their illegal videos and photos
across hundreds or thousands of affected machines
inside of this botnet.
Another common use of botnets is use them to spam others
by sending out phishing campaigns and other malware
to their targets around the world.
But, by far, the most common use of a botnet
is to conduct a DDoS attack
which is known as a Distributed Denial of Service attack.
Now, a Distributed Denial of Service attack,
known as a DDoS,
will occur anytime you have a lot of machines
targeting a single victim
and then attacking them all at the same time.
Now, let's assume that I'm a threat actor,
and I have control over 100,000 machines
as part of my botnet.
If I wanted to take down your organization's website,
I can use my C2 node to order all 100,000 zombies
in my botnet to target your victimized server
and make requests to it repeatedly
until the amount of load is so much
that it forces your web server offline.
Essentially, your organization can't handle all the load
that I'm sending to it,
and so the web server will actually crash
and not be able to perform its function
for your legitimate users or customers.
Since around 2015 though,
many threat actors have begun to use botnets
to make money by using their zombies
to do processor intensive things like crypto mining
on their behalf too.
So if an attacker can get 10,000 or a 100,000 zombies
as part of their botnet,
they can command those zombies
to give you 20 to 25% of their available processing power
so they can continually mine cryptocurrency
in the background without your knowledge or consent.
Now, by doing this, they can have a lot of zombies
working in parallel to mine coins
that can be stored in the attacker's digital wallet
by redirecting the gain coins
through their command and control nodes.
Another use of botnets by attackers
is use this combined processing power
to break through different types of encryption schemes.
Here again, the attacker is trying to gather
as many zombies as possible
to add them to this distributed computational network
in order to use some of each
of the zombies' processing capabilities
to brute force different encryption schemas.
Now, to avoid detection,
attackers will usually not take up all
of your computing power
but instead they'll usually use 20 or 25%
of your available processing power,
so it takes you a little bit longer to detect that,
and that way you don't realize your machine
has been compromised.
After all, if I broke into your machine
and took over 90 to a 100% of your processing power,
your computer would fail to respond to your own requests,
and then you'll start looking for the cause of that,
which would, in this case,
find that you are now part of my botnet as a zombie.
And so most attackers aren't going to be greedy
and they're not going to try to use up all 90 to 100%
of your processing power,
and they'll stick with only 20 to 25%
across hundreds or thousands of zombies
to still have a great computational network
and tons of processing power at their disposal
for all the malicious or nefarious things they want to do,
like conducting Distributed Denial of Service attacks
or making money through crypto mining.
So remember, botnets and zombies
are used to create large networks of compromised machines.
A botnet is a network of compromised computers or devices
that are controlled remotely by a malicious actor
and they're often used for cyber attacks
or other malicious activities.
A zombie, on the other hand,
is the name of a single compromised computer or device
that's part of the botnet
and it's used to perform the task using remote commands
from the attacker without the user's knowledge.
These botnets are used
to create large distributed computing capabilities
that can be used by an attacker
to conduct a Distributed Denial of Service attack,
for crypto mining, or breaking encryption,
depending on the needs of that attacker
and the commands they send
through their command and control node.