A botnet is a centrally controlled network of compromised computers or other devices. After gaining access, attackers can use the machines for cryptocurrency mining, phishing emails, click fraud, or other profitable activities. section 1.2
A compromised server becomes a bot
An attacker escalates privileges through a rootkit, gains access to the server’s root account, and adds the server to a botnet. The server then performs attacker-directed work, while access to it may also be resold without the owner’s knowledge. section 1.2
Look for signs that compromised computing resources are being controlled or misused:
- Scan network activity for unusual behavior. section 1.2
- Search the filesystem for suspicious files. section 1.2
- Investigate unexplained spikes in resource use, including activity that mimics existing processes or uses local services. section 1.2
