A DDoS botnet is a group of compromised devices that an attacker centrally controls to send large volumes of traffic at a target. The traffic may be simple connection floods, application requests, or amplification abuse, but the goal is the same: exhaust bandwidth, CPU, memory, or session limits so a service becomes slow or unavailable.
DDoS botnets matter because they turn many low-powered hosts—often routers, cameras, or other IoT systems—into scalable attack infrastructure. They are usually built through weak passwords, exposed remote-login services, or malware that adds the device to a command-and-control network. Defenders look for signs such as unusual outbound connections, repeated login attempts, and traffic spikes from diverse source IPs. Mitigations include changing defaults, disabling unnecessary management services like Telnet, segmenting devices, rate limiting, and monitoring for persistent command traffic.