A botnet is a group of internet-connected devices compromised by malware and remotely controlled without their owners’ knowledge. It can include ordinary computers as well as smart TVs, streaming devices, and other connected equipment; criminals use botnets for activities such as DDoS attacks, spam, and information theft.
How a botnet works
The word botnet combines “robot” and “network.” NIST describes botnets as networks of computers taken over with malware and managed remotely by criminals in its botnet glossary entry. The FBI’s 2025 definition broadens the picture to any internet-connected devices: a botnet is “A network of Internet-connected devices compromised by malware that can be controlled remotely without the owners’ knowledge.”
- A device is compromised. Malware may get onto a device in different ways. The route varies; not every botnet relies on the same vulnerability or infection method.
- The operator directs it. Malicious software enables communication or control. Some botnets use command-and-control servers, as described in the FBI’s overview of botnets, but architectures differ.
- The device performs tasks. The operator can coordinate many compromised devices to carry out activity at scale. Owners may not know their device is being used.
A device in a botnet is often called a bot or zombie. The term describes its role in the network, not a particular kind of hardware.
What criminals use botnets for
A botnet is an infrastructure that can be put to different criminal uses; a given botnet does not necessarily do all of these.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitches#1 Best Overall
- DUAL-BAND WIFI 6 ROUTER: Wi-Fi 6(802.11ax) technology achieves faster speeds, greater capacity and reduced network congestion compared to the previous gen. All WiFi routers require a separate modem. Dual-Band WiFi routers do not support the 6 GHz band.
- AX1800: Enjoy smoother and more stable streaming, gaming, downloading with 1.8 Gbps total bandwidth (up to 1200 Mbps on 5 GHz and up to 574 Mbps on 2.4 GHz). Performance varies by conditions, distance to devices, and obstacles such as walls.
- CONNECT MORE DEVICES: Wi-Fi 6 technology communicates more data to more devices simultaneously using revolutionary OFDMA technology
- EXTENSIVE COVERAGE: Achieve the strong, reliable WiFi coverage with Archer AX1800 as it focuses signal strength to your devices far away using Beamforming technology, 4 high-gain antennas and an advanced front-end module (FEM) chipset
- OUR CYBERSECURITY COMMITMENT: TP-Link is a signatory of the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Secure-by-Design pledge. This device is designed, built, and maintained, with advanced security as a core requirement.
- Distributed denial-of-service (DDoS) attacks: many devices send traffic toward a target, potentially disrupting access to a website or service.
- Spam and malware distribution: compromised devices can send unwanted messages or help spread malicious software.
- Proxy services: traffic can be routed through victims’ internet connections, disguising the criminal operator’s activity. In its BADBOX 2.0 alert, the FBI says compromised home networks may be sold or made available for criminal use.
- Information theft: malware may collect sensitive data such as passwords or financial details.
The FBI describes these and other uses in its botnet explanation.
Why connected home devices can be targets
Botnets are not limited to laptops and desktop computers. The FBI’s June 5, 2025 BADBOX 2.0 public service announcement describes a campaign affecting internet-connected devices, including TV streaming devices, digital projectors, aftermarket vehicle infotainment systems, and digital picture frames.
Rank #2
- Dual-band Wi-Fi with 5 GHz speeds up to 867 Mbps and 2.4 GHz speeds up to 300 Mbps, delivering 1200 Mbps of total bandwidth¹. Dual-band routers do not support 6 GHz. Performance varies by conditions, distance to devices, and obstacles such as walls.
- Covers up to 1,000 sq. ft. with four external antennas for stable wireless connections and optimal coverage.
- Supports IGMP Proxy/Snooping, Bridge and Tag VLAN to optimize IPTV streaming
- Access Point Mode - Supports AP Mode to transform your wired connection into wireless network, an ideal wireless router for home
- Advanced Security with WPA3 - The latest Wi-Fi security protocol, WPA3, brings new capabilities to improve cybersecurity in personal networks
According to the FBI, devices in this campaign could be compromised before purchase with malicious software or infected after purchase when users download malicious apps, including from unofficial marketplaces. The FBI said most infected devices in this campaign were manufactured in China; that is a statement about BADBOX 2.0, not a basis for judging devices from any country generally.
The FBI lists possible warning signs such as an unfamiliar brand, an unrecognized app marketplace, a request to turn off Google Play Protect, a generic streaming device advertised as unlocked or offering free content, an Android device that is not Play Protect certified, or unexplained internet traffic. These are clues to investigate, not a diagnostic test: the FBI cautions that any one indicator by itself does not establish malicious activity or a crime.
Rank #3
- New-Gen WiFi Standard – WiFi 6(802.11ax) standard supporting MU-MIMO and OFDMA technology for better efficiency and throughput.Antenna : External antenna x 4. Processor : Dual-core (4 VPE). Power Supply : AC Input : 110V~240V(50~60Hz), DC Output : 12 V with max. 1.5A current.
- Ultra-fast WiFi Speed – RT-AX1800S supports 1024-QAM for dramatically faster wireless connections
- Increase Capacity and Efficiency – Supporting not only MU-MIMO but also OFDMA technique to efficiently allocate channels, communicate with multiple devices simultaneously
- 5 Gigabit ports – One Gigabit WAN port and four Gigabit LAN ports, 10X faster than 100–Base T Ethernet.
- Commercial-grade Security Anywhere – Protect your home network with AiProtection Classic, powered by Trend Micro. And when away from home, ASUS Instant Guard gives you a one-click secure VPN.
What to do if a device seems suspicious
- Review what is connected. Check the connected-device list in your router or network app, and identify devices you recognize. The FBI recommends assessing the IoT devices on your home network.
- Check the device and its apps. Look for unfamiliar apps or marketplaces, unexpected requests to disable built-in protections, or device certification concerns. An individual sign is not proof of infection.
- Monitor network activity. The FBI recommends monitoring home internet traffic. If you cannot identify unexpected activity, ask your internet service provider or device maker for help interpreting it.
- Use official update channels. Install available operating-system, app, and firmware updates from the device maker or the device’s official app store. The FBI calls timely patching one of the most efficient and cost-effective steps for minimizing exposure to cybersecurity threats.
- Get help if concerns remain. Contact the device maker or service provider about a suspicious device. If you suspect criminal activity or a compromise, the FBI alert recommends filing a report with the Internet Crime Complaint Center.
How to reduce the risk of a botnet infection
- Keep software and firmware current. Apply updates through official channels rather than links or installers from unknown sources.
- Avoid unofficial app marketplaces. Be wary of apps that ask you to disable security protections, and use the device maker’s or platform’s official distribution channel.
- Know what is on your network. Periodically review connected devices and investigate items you cannot identify.
- Consider network-level restrictions. NIST’s May 26, 2021 practice guide, Securing Small-Business and Home Internet of Things (IoT) Devices, explains Manufacturer Usage Description (MUD). A network using MUD can restrict an IoT device to the communications needed for its intended function and block other traffic. NIST says this can reduce vulnerability to botnets and other network threats, and limit potential harm if a device is exploited. MUD is one protective layer, not a guarantee against compromise; check current network-equipment specifications to confirm whether this capability is supported.
How large are botnets?
Botnet figures need to be tied to a named operation and date. They are not interchangeable estimates of a single worldwide total.
Quick Recap
Best Value
- Dual band router upgrades to 1200 Mbps high speed internet (300mbps for 2.4GHz plus 900Mbps for 5GHz), reducing buffering and ideal for 4K stream
- Full Gigabit Ports - Gigabit Router with 4 Gigabit LAN ports, ideal for any internet plan and allow you to directly connect your wired devices
- Boosted Coverage - Four external antennas equipped with Beamforming technology extend and concentrate the Wi-Fi signals
- MU-MIMO technology - (5GHz band) allows high speeds for multiple devices simultaneously
- Access Point Mode - Supports AP Mode to transform your wired connection into wireless network, an ideal wireless router for home
Rank #4
- Tri-Band WiFi 6E Router - Up to 5400 Mbps WiFi for faster browsing, streaming, gaming and downloading, all at the same time(6 GHz: 2402 Mbps;5 GHz: 2402 Mbps;2.4 GHz: 574 Mbps)
- WiFi 6E Unleashed – The 6 GHz band brings more bandwidth, faster speeds, and near-zero latency; Enables more responsive gaming and video chatting
- Connect More Devices—True Tri-Band and OFDMA technology increase capacity by 4 times to enable simultaneous transmission to more devices
- Unique Design, More RAM, Better Processing - A unique housing design provides optimal heat dissipation, combined with a 1.0 GHz dual-core CPU and 512 MB High-Speed Memory, the AXE75 is designed for long-term reliability and performance.
- EasyMesh-compatible - Extend network range even more by adding EasyMesh-compatible routers, extenders, or wireless powerline adapters for a seamless, whole-home connection. Eliminate dead zones, drops, and lag as you move across your home.
| Source and reporting period | Figure | What it describes |
|---|---|---|
| FBI, June 5, 2025 | “Millions of infected devices” | The FBI’s characterization of the BADBOX 2.0 botnet in its alert; not a global botnet count. |
| FBI, Cyber National Mission Force, and NSA, September 18, 2024 | Over 260,000 devices as of June 2024 | The size of the Integrity Technology Group-managed botnet described in their joint advisory. The advisory also says it regularly maintained between tens to hundreds of thousands of compromised devices. |
| ENISA, report published October 1, 2025; revision notice September 22, 2026 | 4,875 incidents analyzed | The ENISA Threat Landscape 2025 covers July 1, 2024–June 30, 2025. This is broad threat-landscape context, not a count of botnet incidents. |
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
