The little box sitting beneath your television, blinking its reassuring green light, has a second job. So does the router in your hallway, the IP camera watching your front porch, and possibly the cheap Android set-top box someone gave you as a gift. While you sleep, these devices may be firing spam at inboxes in Zurich, probing banks in Singapore for weak passwords, or helping to knock a hospital’s website offline. You are not being targeted. You are being used.
This is how botnets work, and why they have become one of the most persistent and underappreciated problems in cybersecurity. Unlike ransomware attacks that announce themselves with a terrifying message on your screen, botnet infections are designed to be invisible. The whole point is that you never notice.
What a Botnet Actually Is
A botnet is a network of internet-connected devices that have been compromised by malware and placed under the control of a remote operator, typically called a “bot herder” or operator. Each infected device, called a bot or zombie, receives instructions through a command-and-control infrastructure. That infrastructure can range from a single central server to a decentralized peer-to-peer network where each bot relays commands to others, making the whole system far harder to dismantle.
The operator rents or uses this network to carry out tasks at scale: sending phishing emails, conducting distributed denial-of-service (DDoS) attacks that overwhelm websites with traffic, stuffing stolen credentials into login pages to find which ones still work, mining cryptocurrency, or acting as a proxy layer that obscures the true origin of malicious traffic.
What makes modern botnets particularly effective is the sheer diversity of their membership. A botnet is not just a collection of compromised laptops. Researchers have documented botnets composed primarily of home routers, digital video recorders, security cameras, smart televisions, and set-top boxes running outdated firmware. These devices share a common set of vulnerabilities: they are always on, they are almost never updated, they face the open internet, and their owners rarely think of them as computers at all.
How Devices Get Recruited
Infection usually follows one of a few well-worn paths. The most common involves scanning the entire IPv4 address space, all roughly four billion addresses, for devices with known vulnerabilities or default credentials. Automated tools can complete a full scan of the internet in under an hour. When a vulnerable device is found, the malware attempts to log in using factory-default usernames and passwords, a technique that remains astonishingly effective because a large share of home devices are never reconfigured out of the box.
Once inside, the malware typically downloads a payload suited to the device’s architecture, since IoT devices run on a variety of processor types, and then attempts to establish persistence. On many routers and set-top boxes, this means modifying startup scripts or replacing legitimate system binaries. Some sophisticated variants also attempt to close the vulnerability they used to get in, preventing rival malware from taking over the same device.
The Mirai botnet, which caused widespread internet disruption in 2016 when it was used to attack DNS provider Dyn, operated almost entirely on this principle. Its source code, which was released publicly that same year, became the foundation for dozens of successor variants. Security researchers have tracked Mirai-derived malware continuously in the years since, with new variants regularly emerging that expand the list of targeted devices or improve evasion techniques.
More recently, law enforcement and researchers have documented botnets that recruit devices through a different vector: malicious firmware bundled with cheap consumer hardware, particularly low-cost Android set-top boxes sold through major online marketplaces. In 2023, researchers at Human Security published findings describing a network of infected Android TV boxes that had been sold with malware pre-installed at the factory level, or introduced somewhere in the supply chain. The operation, which the researchers called BADBOX, affected devices that were marketed under multiple brand names and appeared on mainstream retail platforms. The malware turned these boxes into residential proxies, meaning that internet traffic from criminals could appear to originate from an ordinary home IP address, a capability that is extremely valuable for fraud operations.
The BADBOX findings illustrated a troubling evolution: rather than waiting for owners to make a security mistake, some botnet operators are now investing in supply chain compromise so that devices arrive infected before the first power-on.
Why Your Router Is Such a Tempting Target
Home routers occupy a uniquely privileged position in your network. All traffic in and out of your home passes through the router, which means a compromised router can potentially intercept unencrypted communications, redirect DNS queries to malicious servers, or silently modify web pages. More commonly, operators simply exploit the router’s persistent internet connection and residential IP address.
Residential IP addresses are commercially valuable in the criminal ecosystem because many fraud detection systems treat traffic from data center IP addresses with high suspicion, while traffic appearing to come from a home cable or fiber connection looks normal. A botnet composed of millions of home routers can effectively launder the origin of malicious traffic, making it look like it is coming from ordinary households around the world.
Router manufacturers have, for years, shipped products with known security weaknesses. Common problems include default credentials that are the same across entire product lines, remote management interfaces enabled by default and exposed to the internet, and firmware that receives security updates only for a short period after sale, if at all. Security researchers have repeatedly demonstrated that many routers sold at retail contain vulnerabilities that remain unpatched for years.
The scale of the problem is substantial. Security firms tracking botnet activity routinely count infected devices in the hundreds of thousands to low millions for a single active campaign. The infrastructure required to maintain that many bots is itself a significant criminal enterprise, with operators, developers, and customers organized in commercial markets on closed forums and dark web platforms.
In 2024, the United States Department of Justice and the Federal Bureau of Investigation disrupted a botnet that had been operating through compromised routers, announcing that the network had been used by a state-linked hacking group to conduct espionage and mask the origin of cyberattacks. That action, which involved court-authorized access to infected routers to remove the malware, underscored that botnets are not solely a criminal problem. Nation-state actors use the same infrastructure for intelligence operations.
The Set-Top Box Problem Nobody Is Talking About Enough
Among the various categories of IoT device, the cheap Android set-top box deserves particular attention. These devices, which typically retail for well under one hundred dollars and are sold to stream internet video to older televisions, are manufactured in large volumes by suppliers, many of them based in China, and rebranded by dozens of distributors with little quality control over the software.
Because they run a version of Android, they have access to a full-featured operating system capable of running complex malware. Because they are designed to be “set and forget” devices, they almost never receive firmware updates after purchase. Because consumers think of them as television accessories rather than networked computers, they are essentially never monitored or secured.
The BADBOX research mentioned earlier found that the pre-installed malware on affected devices could perform several functions simultaneously: acting as a residential proxy, conducting ad fraud, creating fake account sign-ups, and potentially loading additional malicious modules remotely. The same researchers identified a follow-on operation, which they called BADBOX 2.0, that showed the underlying infrastructure had not simply gone away after their initial disclosure.
This category of device is difficult to regulate because it sits at the intersection of consumer electronics, software, and international supply chains. A set-top box may be designed by one company, manufactured by another, have firmware written by a third party, and be sold under a brand name owned by a fourth. Assigning responsibility for security is genuinely complicated, and the low price point creates structural incentives against spending money on security engineering.
If you have purchased an inexpensive Android TV box from a lesser-known brand, particularly through a third-party marketplace listing, security researchers broadly advise treating it with caution. There is no reliable way for a consumer to audit the firmware of such a device without specialized tools. Using a dedicated streaming device from a major brand rather than an unbranded Android box is, at present, one of the more practical ways to reduce this specific risk.
What Can Actually Be Done
The responses to the botnet problem operate at several levels, and none of them is sufficient on its own.
At the device level, consumers can reduce their risk by changing default passwords on routers and other networked devices, disabling remote management interfaces that are not needed, and keeping firmware updated. For routers specifically, replacing aging hardware with a model that still receives active security support matters more than most people realize. A router with automatic security updates from a manufacturer with a track record of patching vulnerabilities is meaningfully safer than one that has been out of support for several years.
Internet service providers have the technical ability to detect patterns of traffic consistent with botnet activity originating from their customers’ connections. Some ISPs participate in programs that notify customers when their devices appear to be compromised. This approach has had some success in reducing infection rates, though uptake varies widely across providers and countries.
At the regulatory and industry level, there has been meaningful movement in several jurisdictions toward mandating minimum security standards for consumer IoT devices. In the United Kingdom, legislation requiring manufacturers to prohibit universal default passwords and to maintain a public disclosure policy for vulnerabilities came into force in 2024. The United States has been building a voluntary labeling program, the Cyber Trust Mark, organized through the Federal Communications Commission and intended to help consumers identify devices that meet a baseline security standard, though as of late 2026 its implementation rules were still being finalized and labeled products had not yet reached shoppers. Critics argue that voluntary schemes do not create sufficient incentives for manufacturers who compete primarily on price, and that mandatory minimum standards with real enforcement are necessary to change market behavior.
Law enforcement takedowns have disrupted specific botnets but have not solved the underlying problem. When Mirai’s source code was published in 2016, it effectively handed a toolkit to any operator willing to use it. Botnets that are taken down are frequently rebuilt, and the criminal and espionage demand for this kind of infrastructure does not disappear because one particular network is dismantled.
The peer-to-peer architectures used by more sophisticated botnets make takedown particularly difficult. Unlike a botnet that depends on a single command-and-control server, a peer-to-peer botnet distributes its control functions across many infected devices. Removing any single node does not meaningfully impair the network, and identifying the human operators behind it requires extensive international law enforcement cooperation.
Living with a Problem That Will Not Go Away Quickly
The botnet problem is, at its core, an economic problem. Devices are cheap to manufacture insecurely and expensive to manufacture securely. The costs of insecurity fall almost entirely on people who are not the manufacturer: on the victim of a DDoS attack, on the bank whose login page is being credential-stuffed, on the hospital whose systems go offline. The device owner whose router is recruited into a botnet usually suffers nothing noticeable at all. These misaligned incentives have persisted for decades, and fixing them requires either regulation that changes what manufacturers must do, liability rules that change what it costs them not to, or both.
In the meantime, the internet’s infrastructure continues to depend on the security of hundreds of millions of devices owned by people who have no particular reason to think of their television box as a cybersecurity concern. That gap between how we think about these objects and what they actually are, small networked computers running persistent software connected to the global internet, is the space in which botnets thrive.
The green light on your set-top box keeps blinking. It almost certainly means nothing sinister. But the fact that you cannot easily tell the difference is precisely the problem.
For consumers who want to take practical steps, keeping router firmware current is worth the effort, and a network monitoring tool for home use can at least alert you to unusual traffic patterns that might indicate something on your network is misbehaving. Vigilance will not solve a systemic problem, but it can mean your devices are not the path of least resistance.
As an Amazon Associate, The Rough Idea earns from qualifying purchases.