Your device can work for someone else while still working for you
A botnet is a collection of compromised devices that an unauthorized operator coordinates for malicious activity. Each recruited computer, router, camera, or other device contributes something the operator wants: network capacity, computing resources, access, or a connection that appears to come from an ordinary household or business. The owner may still be able to use the device normally. That is why the familiar image of a visibly broken computer misses an important part of the risk. A camera can continue displaying video while participating in an attack elsewhere. This guide follows the device from recruitment to remote control, explains two documented examples, and shows how an owner can investigate and recover without assuming that every slow connection is proof of a botnet.
A botnet combines compromise with coordination
The FBI’s Internet Crime Complaint Center describes a botnet as a network of hijacked devices used for cyberattacks and other malicious activity. The essential elements are unauthorized control and coordinated use. An internet-connected device is not automatically a bot, and a collection of legitimate automated programs is not automatically a malicious botnet. Authorization and behavior distinguish a useful managed fleet from devices secretly serving someone else’s purpose.
The word network here does not mean all the devices share one household Wi-Fi connection. Recruited devices can belong to unrelated people in different places. The operator coordinates them through communications infrastructure, while their owners may have no relationship with one another. This distribution is one reason the harm can extend far beyond the first compromised device.
Recruitment depends on a route into the device
A device can be recruited when an attacker exploits a software weakness, obtains administrative access, or persuades someone to install malicious software. The route varies by campaign and device type. A laptop receiving an untrusted installer presents a different situation from an exposed camera-management service. No single warning sign or protective setting covers every route.
Internet-facing devices deserve attention because an attacker may be able to reach their services without first joining the owner’s local network. Changing a Wi-Fi password does not necessarily change a device’s separate administration password or remove a service exposed through the router. Owners need to understand which password and which connection they are changing before treating the action as a fix.
Some compromises can precede ordinary use. A June 2025 FBI advisory about BADBOX 2.0 described affected consumer devices with malicious software installed before purchase or introduced through required application downloads. The advisory concerned a particular campaign and product context. It shows why recruitment cannot always be reduced to a user clicking an obviously suspicious email.
Command and control turns individual infections into coordinated activity
Command and control, often abbreviated C2, is the means by which an operator communicates with compromised devices. Instructions can tell the devices what work to perform, and communications may carry results or status back. A centralized arrangement uses coordinating servers; other designs distribute communications across peers. Microsoft’s research on the Mozi IoT botnet provides a documented example of peer-to-peer coordination. There is no universal single server whose removal automatically cleans every botnet.
What the recruited devices can be used for
A distributed denial-of-service attack uses many sources to overwhelm a target or its supporting infrastructure. From the target’s perspective, traffic arrives from numerous places; from the device owner’s perspective, a hijacked device is being made to send traffic without permission. The attacked service and the recruited device owner are both victims, although their immediate problems differ. Website availability response belongs with the service operator; device cleanup belongs with the person or organization responsible for the bot.
Botnet activity is not limited to denial of service. The capabilities depend on the malware and operator’s purpose. Some compromised devices may support information theft or unauthorized proxy services. A proxy passes another party’s traffic through a connection; when criminals misuse a household connection this way, activity can appear to originate from that household even though the owner did not initiate it.
Mirai illustrates how small devices can cause large effects
A July 2017 Justice Department guide describes the October 21, 2016 attack against Dyn using thousands of Mirai-infected IoT devices. Their traffic overwhelmed Dyn’s systems and disrupted access to websites relying on its services. The example is historical, but the relationship is easy to understand: many individually modest devices can become a significant collective resource when an operator directs them together.
The device owner did not need to be interested in Dyn or even know what service Dyn provided. The owner’s equipment supplied part of the attack capacity. This is why securing a low-cost connected device matters even when it stores little information the owner considers private. Its internet access and processing ability may be useful to someone else.
Do not generalize the case into a claim that all modern botnets work exactly like Mirai. Different campaigns use different recruitment methods and tasks. The transferable lesson is that a device’s intended function does not define every function an attacker might force it to perform. A digital recorder remains a computer with software, credentials, and network access that need attention.
A household example: investigate the specific device
Imagine a household receives an internet-provider notice about suspicious traffic associated with its connection. The home contains laptops, phones, a camera, and an old streaming box. The public internet address alone does not identify which device caused the activity. The useful next step is to verify the notice through the provider’s established contact route, then obtain the relevant time, type of activity, and any device-level information available.
Turn the household inventory into a narrowing exercise
List connected devices and identify who owns each one. Use the router’s documented device list where available, recognizing that unfamiliar names can belong to ordinary equipment. Compare the list with the camera, printer, consoles, smart-home accessories, and computers actually in use. Do not assume an unfamiliar entry is an intruder without checking its identity.
If the streaming box has no identifiable support source and requires disabling protective settings to install unofficial applications, that deserves closer attention. The FBI’s BADBOX advisory lists relevant indicators while warning that an indicator alone does not establish malicious activity. The correct conclusion is that the device warrants investigation or disconnection, not that every inexpensive or unfamiliar device has been proven infected.
Where it is safe to do so, isolate a suspect nonessential device while seeking trusted support. Observe whether the provider’s evidence and the device’s behavior support the same timeline. A reduction in traffic can be useful context, but it is not a complete forensic diagnosis by itself. Keep track of what changed so that ordinary troubleshooting does not erase the distinction between evidence and guesswork.
Slowness is a symptom with many possible explanations
Network congestion, backups, updates, weak wireless coverage, and failing hardware can all make a connection feel slow. A botnet may generate unusual traffic, but performance alone is not a reliable test. More useful evidence can include a verified provider notice, a trusted security alert, an identified malicious application, or documented device behavior matching a specific advisory. Treat each clue according to what it actually establishes.
Consumer routers vary widely in the visibility they provide. A graph showing total traffic may not reveal which application generated it, and an unfamiliar destination may be a legitimate vendor service. If the evidence exceeds your ability to interpret it, ask the provider, manufacturer, or a qualified technician for help. Avoid downloading packet-analysis utilities or “botnet removers” from unsolicited support messages.
Recovery must close the route that allowed recruitment
Disconnecting a suspect device can prevent its current network participation, but it does not establish that the device has been repaired. Follow the manufacturer’s recovery guidance for the exact model and consult the responsible IT team for managed equipment. Depending on the findings, recovery may require a trusted reinstall, firmware recovery, removal from service, or replacement. A factory reset has different effects on different products and is not a universal guarantee of clean firmware.
Why rebooting or resetting may provide only temporary relief
A restart can change visible behavior without correcting the underlying exposure. If an unpatched service or unchanged administrative credential remains reachable, the same route may permit another compromise. A reset can also restore insecure settings or remove a configuration needed for legitimate use. Plan recovery with the product’s documentation rather than repeating resets until the warning disappears.
For the household streaming box, the owner should determine whether trustworthy software and ongoing support are available. If the device cannot be brought to a supported, trustworthy state, leaving it disconnected and replacing it may be more appropriate than repeatedly reintroducing it to the network. Cost and convenience matter, but neither makes an unexplained backdoor acceptable. A working picture on the television is not evidence that the network behavior is safe.
Make routine device care specific enough to complete
Maintain a small inventory containing the device’s model, purpose, support source, and update method. Change configurable default administrative credentials, install supported security updates, and disable unnecessary remote administration according to vendor guidance. These are different tasks: changing a password does not install a patch, and applying a patch does not remove an account you no longer need. Check the actual result of each change.
Separate less-trusted devices from sensitive work where your network supports appropriate isolation, and verify that the chosen arrangement provides the intended separation. A guest network’s name alone does not explain its access rules. Keep the setup manageable enough that you can still update and recover the devices. Segmentation reduces possible reach; it does not make a compromised device harmless to outside targets if unrestricted internet access remains.
Include retirement in the plan. When support ends, the owner needs to decide whether the remaining exposure is acceptable, whether the device can operate safely without network access, or whether replacement is necessary. Before disposal or transfer, use documented data-removal and account-unlinking procedures. An unused smart device that remains powered and connected is still part of the environment, even if nobody remembers buying it.
Buying decisions should include a support test
Before adding another connected product, try answering a few practical ownership questions from its official documentation. Can you identify the exact model, find a security-update procedure, change the relevant administration credentials, and determine how to stop remote access? If these answers are missing, the low purchase price may conceal a maintenance problem. A product that nobody can confidently update or recover creates work later, particularly when it is installed in a hard-to-reach place or becomes essential to daily routines.
For example, a household replacing the suspect streaming box could compare two devices by the support information available rather than only by advertised features. One might have a clear update process and an identifiable support channel; the other might require unexplained apps and provide no recovery documentation. This comparison does not prove the first device cannot be compromised. It gives the owner a usable way to maintain it and respond if something goes wrong. Keep the receipt and model information with the inventory, and choose a household member responsible for checking support notices. That turns prevention into a manageable task instead of expecting everyone to recognize botnet traffic. For a small business, the same responsibility should belong to the person or provider managing the equipment.
Know which problem you are trying to solve
A botnet incident can involve a compromised device, an attacked service, and stolen account access at the same time. Owners should address their equipment and any credentials exposed through it; service operators need a separate availability-response plan with their providers. Blocking one suspicious destination does not prove the entire device is trustworthy again. Recovery is more convincing when the owner can explain the recruitment route, the corrective work, and the reason the equipment is safe enough to reconnect.
If the internet provider supplied the warning, ask how the household should follow up after corrective work. The provider may see activity associated with the connection while the technician sees the local device. Connecting those perspectives can help assess whether the reported behavior continues. Neither party should claim more visibility than it actually has.
Keep a short recovery record identifying the equipment and the action taken. Include any unresolved uncertainty, such as unavailable firmware support or a warning whose device source was not established. That record helps the next support person avoid repeating the same guesses. It also gives the owner a clear reason to keep questionable equipment out of service.
