Botnet

A botnet is a network of compromised devices, commonly known as zombie hosts, that are controlled by a threat actor often referred to as the botmaster, and used to facilitate large-scale phishing operations and other forms of cybercrime, such as credential exfiltration and malware distribution.

Why It Matters

Botnets play a critical role in cyber threats by enabling massive operational capabilities. For phishing and social engineering attacks, botnets offer vast scalability. One of their key advantages is the ability to deploy attacks from a diverse set of source IP addresses across multiple autonomous systems. This diversity complicates attribution efforts and aids in bypassing network filtering mechanisms. By leveraging geographically distributed zombie hosts, attackers can overcome per-IP rate limits and evade reputation-based blacklists, significantly increasing the chances of a successful phishing campaign. Consequently, these capabilities allow the botmaster to launch vast email flooding or credential-stealing campaigns that can target different regions simultaneously, achieving greater penetration rates.

In the context of a phishing botnet, the C2 callback architecture is a pivotal component for coordination and management. Upon infection, each zombie host periodically checks in with the C2 server to receive job instructions, such as send commands for distributing phishing emails. The botmaster issues these commands, which are then disseminated through the C2 mesh to allocate tasks effectively among the compromised hosts. Additionally, these zombie hosts are involved in feeding back stolen credentials through the relay chain, funneling sensitive information to the botmaster securely. This architecture is highly resilient, allowing the phishing operation to remain functional even if multiple nodes are disrupted.

In Practice


Received: from [195.123.45.67] (EHLO random-host-1.local) by intermed-1.example.net with SMTP; Thu, 28 Sep 2023 15:06:22 +0000

Received: from [203.61.14.22] (EHLO mismatched-domain.com) by dest-smtp-server.com with SMTP; Thu, 28 Sep 2023 14:45:12 +0000

Received: from [188.245.4.90] (EHLO compromised-client.local) by zombie.example.com with SMTP; Thu, 28 Sep 2023 14:30:47 +0000

This example illustrates an Emotet SMTP relay chain with a realistic multi-hop

Received:

header path, showcasing how an email is bounced through various IPs before reaching its destination. Each hop indicates where an infected zombie forwards the message. The headers display hostname mismatches like “random-host-1.local” and “mismatched-domain.com,” which are indicative of misconfigured or compromised systems, highlighting the characteristics of such a relay structure. The intermediate relay and delivery MTA stages demonstrate how attackers obfuscate the origin of phishing emails.


template_id: 3214

smtp_creds: "user:pass@smtp.mailserver.com"

target_shard: 15

send_window_utc: "2023-09-29T04:00:00"

throttle_rate: 250 emails/hour

In this Necurs example, a decoded spam job ticket reveals how the botmaster distributes specific sending tasks. These fields are distributed over the P2P Distributed Hash Table (DHT), a decentralized system that bots use to pull job instructions, reducing dependency on a single C2 server. The use of P2P DHT complicates takedown efforts, as it disperses control across many network nodes, each capable of independently sustaining botnet activities even if part of the infrastructure is dismantled.


telnet 192.168.1.1 23

echo "set -o neteof; /path/to/sendmail -bs -q1m" | /bin/sh

This shell command segment represents how a Mirai-variant can repurpose a compromised IoT device, like a Netgear router, into an SMTP relay. Configuring sendmail or executing a Perl one-liner on such devices turns them into relay points for phishing spam. Unlike PC-based botnets, IoT bots leverage devices with limited processing power but high penetration potential, exploiting widespread vulnerability in consumer-grade devices globally. The resulting SMTP banner may resemble devices rather than typical email servers, creating distinct fingerprints for such compromised relays.

Related Terms

A zombie host refers to an individual device within a botnet, often compromised to aid in malicious operations without the owner’s awareness. The botmaster is the entity or individuals managing and directing the botnet. C2 is shorthand for command and control, the communication framework used by the botmaster to issue instructions and receive feedback from the botnet. A spam relay is an operational feature within a botnet, utilizing compromised devices to send unsolicited emails. Credential exfiltration involves stealing credentials through phishing strategies and returning them to the botmaster for misuse or sale.

Botnet

Why It Matters

In Practice

Related Terms

References

Related Reading