What Is a Botnet?
A botnet is a network of internet-connected devices that have been infected with malware and are remotely controlled by an attacker through a command-and-control (C2) server.
Each infected device is called a bot. When thousands or hundreds of thousands — of these bots work together, they form a botnet.
Botnets are commonly used for large-scale attacks such as DDoS, spam campaigns, credential stuffing, and data theft.
Mirai Botnet Series - Part 1 of 6
You are at the beginning. No prior knowledge needed.
| Part | Title | Status |
|---|---|---|
| 1 — You are here | From Zero to Botnet: What Is a Botnet and Why Should You Care? |  |
| 2 | How Mirai Actually Infects a Device | |
| 3 | I Opened Mirai’s Source Code — Here Is What I Found | |
| 4 | I Read Mirai’s Scanner Code — Here Is How It Infects Millions | |
| 5 | I Read the Brain of Mirai — How the C2 Server Actually Works | |
| 6 | Mirai’s Weapons — How 600,000 Cameras Brought Down the Internet | |
Next → Part 2: How Mirai Actually Infects a Device
Before We Start
Most security blogs about botnets assume you already know what a botnet is.
They jump straight into C2 infrastructure, infection vectors, and DDoS mechanics leaving beginners completely lost.
This blog is different.
I am a beginner too. I wrote this while learning. Every confusion I had, every “wait, that doesn’t make sense” moment I documented it. Because I know that if I was confused, someone reading this will be confused at the exact same point.
So we will go slowly. We will build everything from the ground up.
By the end, you will not just know what a botnet is you will understand how to think about one.
Let’s go.
Part 1 — Something Is Happening On Your Device Right Now
Let me start with a story.
Somewhere in the world, there is a cheap security camera. It is mounted outside a restaurant in Vietnam. The owner bought it for $15. It is recording the parking lot. Nobody is thinking about it.
But that camera is also doing something else.
Every few seconds, it sends a small signal to a server. Not video footage. Not anything the owner can see. Just a quiet little “I’m here. I’m ready.”
The restaurant owner has no idea.
The server collects these signals from 100,000 other devices routers in Brazil, DVRs in Turkey, webcams in India. All of them. Quietly waiting.
Then one day, the server sends one message back to all of them:
“Attack this IP address. Now.”
And 100,000 devices simultaneously flood one target with useless traffic. The target goes offline in seconds.
The restaurant owner in Vietnam never knew his camera did anything.
That is a botnet.
Part 2 — Wait. How Does a Camera “Attack” Something?
This was my first confusion too. A camera records video. How does it attack a server?
Here is the key thing to understand:
Every device connected to the internet can send data.
Your camera sends video footage to your phone over the internet. That means it can send data. The attacker does not care what kind of data. He just needs the camera to send as much data as possible to one target.
So “attacking” just means this:
Normal camera:
Camera ---> sends video data ---> your phone app
Infected camera:
Camera ---> sends garbage data ---> victim's server
millions of packets
non-stop
100,000 cameras doing this simultaneously
One camera doing this? The target server handles it easily.
But 100,000 cameras all doing this at the same exact time?
The target server gets completely overwhelmed. It cannot handle real traffic anymore. It goes down.
Think of it like a phone number. One person calling annoying but fine. 100,000 people calling the same number at the same exact moment the line is jammed. Nobody real can get through.
That is the entire attack. Not magic. Just volume.
Part 3 — The Three Players You Need to Know
Every botnet story has three players. Burn these into your memory.
┌─────────────────────────────────────────────────────┐
│ │
│ ATTACKER │
│ The person who controls everything │
│ Sits far away. Types commands. │
│ │
│ │ │
│ ▼ │
│ │
│ C2 SERVER (Command and Control) │
│ The middleman server │
│ Receives signals from bots │
│ Sends commands back to bots │
│ │
│ │ │
│ ▼ │
│ │
│ BOTS (Infected Devices) │
│ Cameras, routers, DVRs │
│ All connected. All waiting. All ready. │
│ │
└─────────────────────────────────────────────────────┘
The C2 server is the most important piece here. Let me explain it properly.
Part 4 — What Is a C2 Server?
You use WhatsApp, right?
When you send a message to your friend, it does not go directly from your phone to theirs. It goes to WhatsApp’s server first. The server receives it, stores it, and delivers it to your friend.
Your Phone ──▶ WhatsApp Server ──▶ Friend's Phone
The server sits in the middle. Two-way communication. You send to it. It sends back to you.
Now replace WhatsApp with an attacker:
Infected Camera ──▶ Attacker's Server ──▶ Attack Command
The infected camera connects to the attacker’s server. Just like your phone connects to WhatsApp. It sends: “I’m infected. I’m online. I’m ready.”
The attacker’s server notes it down. Adds it to the list.
When the attacker wants to attack something, he types one command. His server delivers it to every device on the list simultaneously. Just like WhatsApp delivering your message.
Attacker types: "Attack 8.8.8.8"
│
▼
C2 Server
│
├──▶ Camera in Vietnam "Attack 8.8.8.8" ✓
├──▶ Router in Brazil "Attack 8.8.8.8" ✓
├──▶ DVR in Turkey "Attack 8.8.8.8" ✓
└──▶ Webcam in India "Attack 8.8.8.8" ✓
That attacker’s server — the one sitting in the middle, receiving signals from infected devices and sending commands back — that is the C2 server.
C2 = Command and Control.
It is not a special technology. It is just a normal server the attacker owns or rents. The only thing special about it is its purpose.
Part 5 — But How Did the Camera Get Infected in the First Place?
This is where it gets interesting.
You bought a cheap security camera. TP-Link. $15. You plugged it in. It started working. You never touched the settings again.
That camera has a username and password to log into it remotely. You know what the factory default is?
username: admin
password: admin
Or sometimes:
username: root
password: 12345
The manufacturer set these defaults. And most people never change them.
Now think about what Mirai does.
It scans random IP addresses across the entire internet. Millions of them per second. When it finds a device with port 23 open that is Telnet, a remote login service it tries to log in using a list of 63 common default passwords:
Mirai finds device at 45.32.10.3
│
▼
Try admin / admin → fail
Try root / 12345 → fail
Try admin / password → fail
Try root / root → SUCCESS
│
▼
Device infected.
This is not genius hacking. It is just trying the front door with the most common keys.
And it works on hundreds of thousands of devices. Because most people never change default passwords.
Part 6 — The Part That Shocked Me: Devices Infect Each Other
Here is what I did not expect when I first learned about Mirai.
The attacker does not manually infect every camera one by one. That would take forever for 100,000 devices.
Instead the infected device does the scanning itself.
The moment a device gets infected, the malware makes it do two jobs simultaneously:
Infected Device
│
├── Job 1: Connect to C2 server. Wait for attack commands.
│
└── Job 2: Start scanning the internet for more vulnerable devices.
Find them. Infect them.
Those new devices do the same two jobs.
And so on. Forever.
It spreads like a biological virus. Each infected device becomes a new scanner. Each scanner finds new victims. Those victims become new scanners.
The attacker just started it. The botnet grew itself.
This is why Mirai infected 600,000 devices in a matter of weeks. Not because the attacker worked hard. Because the math of exponential spread is brutal.
Day 1: Attacker infects 1 device
Day 2: That device infects 10 more
Day 3: Those 10 infect 100 more
Day 4: Those 100 infect 1,000 more
...
Weeks later: 600,000 infected devices
Part 7 — The Complete Mirai Flow
Let us put everything together.
STEP 1 — SCANNING
Mirai scans random public IP addresses
Looking for devices with port 23 (Telnet) open
│
▼
STEP 2 — INFECTION
Tries 63 default username/password combinations
If one works → installs malware on the device
Device is now a "bot"
│
▼
STEP 3 — REPORTING
Infected device connects to C2 server
Sends: "I'm online. I'm ready."
C2 server adds it to the list
│
▼
STEP 4 — SPREADING
Infected device simultaneously starts scanning
for MORE vulnerable devices
Each new infection repeats from Step 2
Botnet grows itself
│
▼
STEP 5 — ATTACK
Attacker sends one command to C2 server
C2 delivers it to all 600,000 bots simultaneously
All devices flood the target with traffic
Target goes offline
That is Mirai. Start to finish.
Part 8 — Why Did Nobody Stop It?
One last thing before we close Blog 1.
You might be thinking why did nobody just block those cameras? Why did the internet not stop this?
The answer is what makes botnets so dangerous.
The traffic came from 600,000 different IP addresses. All real devices. All different locations. All different countries. Brazil, Vietnam, Turkey, India, everywhere.
When you try to block an attack, you block IP addresses. But if the attack comes from 600,000 different real IPs you cannot block them all without blocking real users too.
The diversity of the sources is the entire point. That is why botnets are so effective.
What We Learned
Before reading this blog, a botnet was probably just a buzzword.
Now you know:
Botnet = a network of infected devices controlled by one attacker
Bot = a single infected device (camera, router, DVR)
C2 Server = the command-and-control server the middleman
Infection = happens through default credentials on public IP devices
Spreading = each infected device scans and infects more devices
Attack = all bots flood one target simultaneously on command
In Blog 2, we go deeper. We look at exactly how Mirai finds vulnerable devices on the internet the scanning engine, the IP generation logic, and the 63 default credentials hardcoded into Mirai’s source code.