What Is a Botnet? How Hijacked Devices Power DDoS Attacks

In November 2025, Cloudflare absorbed the largest DDoS attack ever publicly disclosed: 31.4 terabits per second, sustained for 35 seconds. The traffic did not come from a data center. It came from a botnet, an estimated one to four million hijacked consumer devices, most of them cheap Android TV boxes whose owners had no idea they were participating.

That is the defining property of a botnet, and the reason it is the delivery mechanism behind almost every large DDoS attack: the attacker never owns the hardware. You do. Or your customers do.

What is a botnet?

A botnet is a network of internet-connected devices that have been infected with malware and placed under the remote control of a single operator, the “bot herder”. Each infected device is a “bot” (or “zombie”). The owners almost never know: the device keeps working, and the malware runs quietly in the background.

Three components make the system work:

• The bots. Any device with a processor and a network connection qualifies: home routers, IP cameras, video recorders, smart TVs, set-top boxes, cloud servers, occasionally desktop PCs. The 2016 Mirai botnet was built almost entirely from consumer IoT devices; the 2025 AISURU botnet from off-brand Android TV boxes.
• The command-and-control channel (C2). The infrastructure through which the operator issues orders: classically a central server, in newer designs a peer-to-peer mesh with no single point to take down.
• The operator. Increasingly not the person using the botnet. Large botnets are rented out as “DDoS-for-hire”, so the person aiming the traffic at a bank may have paid a subscription fee measured in tens of dollars.

How does a device become a bot?

Not through anything the owner did. Botnet malware finds devices on its own, by scanning the entire internet for three kinds of weakness:

• Factory-default credentials. Mirai’s method, and still the most productive one. The malware carries a short list of default username/password pairs (admin/admin, root/12345) and tries them against every device it finds. According to the USENIX Security 2017 analysis of Mirai, that alone grew the botnet to a peak of roughly 600,000 infected devices.
• Unpatched vulnerabilities. Consumer devices rarely receive updates. A flaw disclosed in a router firmware in one year is still exploitable on millions of units years later.
• Trojanized software and supply chains. The AISURU botnet was built largely from compromised, off-brand Android TV boxes: devices that were subverted at or near the point of sale rather than broken into afterwards.

Every new bot immediately starts scanning for further victims, which is why botnet growth is exponential. Mirai infected nearly 65,000 devices in its first 20 hours, doubling in size roughly every 76 minutes early on.

What are botnets used for?

The combined resources of a million devices are the product: bandwidth, IP addresses, compute. The operator sells or uses them for:

• DDoS attacks. The flagship use case, and the one this blog cares about. All members flood one target simultaneously; the target’s capacity is exhausted; legitimate users are locked out.
• Credential stuffing. Trying leaked username/password pairs against login pages, distributed across thousands of IPs so rate limits never trigger.
• Spam and phishing delivery. Residential IPs pass reputation filters that data-center IPs fail.
• Residential proxy networks. Renting the bots’ IP addresses to whoever wants their traffic to look like it comes from a household.
• Cryptomining. Stealing electricity and compute at scale.

Why is botnet traffic so hard to filter?

Because each request, taken alone, looks legitimate. This is the property that breaks naive DDoS defenses:

• Real devices, real IPs. The traffic originates from genuine consumer hardware on residential connections, the same address space as your customers. Blocking by IP reputation blocks customers too.
• Distribution. A million sources sending one request each defeats per-IP rate limiting entirely. No single source ever crosses a threshold.
• Real browsers, real behavior. Modern botnets on Android hardware can run genuine browser engines, execute JavaScript, and pass bot-detection challenges. Our Browser Flood post examines that scenario in detail.
• Geographic spread. Traffic arrives from every region at once. Geo-blocking cuts off markets, not the attack.

The uncomfortable conclusion for defenders: a filter tuned to catch “obviously fake” traffic will pass most of what a modern botnet sends.

From Mirai to AISURU: how big do botnets get?

Three data points, each a public record in its day, show the trajectory:

• September 2016: Mirai vs. KrebsOnSecurity. Over 600 Gbps against a single journalist’s website, from roughly 600,000 infected IoT devices (Antonakakis et al., USENIX Security 2017).
• October 21, 2016: Mirai vs. Dyn. The same botnet aimed at a DNS provider took Twitter, Netflix, Spotify and Amazon offline for large parts of the US and Europe. One company’s resolvers were attacked; half the internet felt it.
• November 2025: AISURU vs. Cloudflare customers. 31.4 Tbps, roughly fifty times the Krebs attack, from an estimated one to four million devices, followed by an HTTP campaign exceeding 200 million requests per second (Cloudflare DDoS threat report, Q3 2025).

And the pace is accelerating. The public record fell four times in the thirteen months to November 2025 alone:

The growth is driven by supply: every year adds billions of cheap, unpatched, internet-connected devices, and every one of them is a potential bot.

What do botnets mean for regulated institutions?

For a bank, insurer or financial market infrastructure, the botnet threat translates into a concrete regulatory expectation: prove that your services stay available under exactly this kind of load.

• DORA (Regulation (EU) 2022/2554) requires digital operational resilience testing of ICT systems supporting critical functions at least yearly (Article 24), with scenario-based testing among the listed methods (Article 25).
• FINMA expects Swiss institutions to manage operational risks to critical services, including cyber scenarios, under Circular 2023/1.
• NIS2 (Directive (EU) 2022/2555) obliges essential and important entities to take measures ensuring service continuity, including attack resilience (Article 21).

None of these frameworks accepts “we have a DDoS protection contract” as evidence. They ask whether the defense works. The only way to know is to subject it to realistic pressure.

How do you test against botnet-scale traffic, without a botnet?

This is the problem Obsidio was built to solve. A realistic test has to reproduce the properties that make botnet traffic dangerous (real devices, residential networks, global distribution, genuine browser behavior) without ever touching a hijacked machine.

Obsidio runs DDoS simulations from 100,000+ real, ethically sourced devices distributed worldwide: hardware whose owners deliberately contribute capacity, orchestrated inside Trusted Execution Environments with full audit logging. The traffic is indistinguishable from a genuine botnet attack, because it has the same shape. But every simulation requires explicit ownership verification of the target, runs under your control with progressive ramp-up, and can be aborted instantly from live metrics.

In other words: the realism of a botnet, with the authorization, control and evidence a compliance team needs. Every run produces a cryptographically attested report that maps to FINMA, DORA and NIS2 expectations.

If you want to know how your defenses behave when a million polite-looking requests arrive at once, start with our guide on how to test your DDoS protection, or talk to our team about a controlled simulation against your own infrastructure.