A zombie is a computer or IoT device secretly controlled by attackers as part of a botnet, usually without its owner noticing.
How a device becomes a zombie
A device turns into a zombie (also called a bot) after it is infected with malware – through a phishing attachment, a trojan, an unpatched vulnerability or a default password. The malware connects to a command-and-control (C2) server and waits for instructions. Thousands or millions of such devices form a botnet. Routers, cameras and other IoT devices are especially popular because they are rarely updated and often have default credentials: the Mirai botnet built in 2016 from such devices took down major websites with a DDoS attack on the DNS provider Dyn.
What zombies are used for
- DDoS attacks against websites and online services;
- sending spam and phishing e-mails;
- credential stuffing and brute-force attacks;
- residential proxy networks that hide criminals’ traffic behind home IP addresses;
- crypto mining and loading further malware, including ransomware.
Why zombies matter for security
Owners of zombie devices are victims, but their devices harm others, slow down their own network and can get their IP addresses blocklisted. Botnets such as Emotet also served as delivery networks for ransomware. International operations such as Operation Endgame (2024) have taken down large botnet infrastructures, but new ones appear constantly.
How to protect your devices
- Change default passwords on routers, cameras and NAS devices and install firmware updates.
- Do not expose management interfaces to the internet.
- Use endpoint protection on computers and watch for unexplained traffic or slowness.
- React to abuse complaints from your provider – they often indicate an infected device.
