What is a botnet and how is it used in DDoS attacks?

A botnet is a network of malware-infected hosts ("zombies") that a threat actor commands via CnC software to launch a coordinated DDoS attack.

A botnet is a network of infected computers (called zombies) controlled by a threat actor.

In DDoS attacks:

1. Threat actor infects multiple hosts with malware
2. Infected hosts become "zombies" in the botnet
3. Threat actor uses Command and Control (CnC) software to coordinate the zombies
4. All zombies simultaneously attack the target, overwhelming its resources

Go deeper:

• Botnet — Wikipedia — explains zombies, command-and-control architectures, and the many uses of botnets beyond DDoS.