Understanding Botnets
A botnet is a network of compromised devices (computers, phones, servers, even IoT devices) that are secretly controlled by an attacker. Once a device is infected with botnet malware, it connects to a command-and-control (C2) server operated by the attacker. The attacker can then issue commands to all infected devices simultaneously.
Botnets are used for a wide range of malicious activities: sending spam, launching denial-of-service attacks, stealing data, mining cryptocurrency, and spreading to other devices on the network.
Key point: The device owner often has no idea their machine is part of a botnet. A compromised device can operate normally for months while silently carrying out an attacker's commands in the background.
How Botnet Protection Works
VeloGuardian's botnet protection operates at the network level through Cloud Shield. On Fortress and Citadel, Cloud Shield blocks known malware domains, which can include botnet command servers:
- C2 server blocking: Known command-server domains on the malware blocklists do not resolve, so the device cannot reach them.
Why Botnet Protection Matters
Even with strong perimeter security, devices can become compromised through phishing emails, infected USB drives, or zero-day exploits. Blocking known command servers can limit the damage when a device is compromised:
- Limits data theft: Blocking can stop a compromised device from reaching known attacker domains.
- Stops DDoS participation: If the command server's domain is blocked, the device cannot receive attack instructions from it.
The Botnet Lifecycle
Understanding how botnets work helps explain where protection is most effective. The lifecycle begins with infection: a device is compromised through phishing, malware, or an exploit. Malware domain blocking is the first line of defense at this stage.
Next comes registration, when the compromised device contacts a C2 server to announce itself. This is where botnet protection intervenes by blocking the outbound communication. If the command server's domain is listed, registration fails. If a device does manage to register, the attacker attempts to send commands: instructions for data theft, spam, or DDoS attacks. With C2 traffic blocked, those commands never arrive, and the execution phase is neutralized.
By blocking communication at the registration and command stages, botnet protection renders the malware ineffective, even if the initial infection succeeds.
Botnet Protection in VeloGuardian
Botnet domain blocking is part of Cloud Shield's malware blocking, on by default on Fortress and Citadel. Because all traffic is routed through the VPN tunnel, it applies whether you are in the office, at home, or on the road.
It is part of Cloud Shield's DNS filtering, alongside ad blocking (Shield and up) and phishing blocking (Fortress and Citadel).