Adversaries may compromise numerous third-party systems to form a botnet that can be used during targeting. A botnet is a network of compromised systems that can be instructed to perform coordinated tasks.(Citation: Norton Botnet) Instead of purchasing/renting a botnet from a booter/stresser service, adversaries may build their own botnet by compromising numerous third-party systems.(Citation: Imperva DDoS for Hire) Adversaries may also conduct a takeover of an existing botnet, such as redirecting bots to adversary-controlled C2 servers.(Citation: Dell Dridex Oct 2015) With a botnet at their disposal, adversaries may perform follow-on activity such as large-scale [Phishing](https://attack.mitre.org/techniques/T1566) or Distributed Denial of Service (DDoS).
Botnet
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1584/005  external_id: T1584.005     source_name: Dell Dridex Oct 2015  description: Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015, October 13). Dridex (Bugat v5) Botnet Takeover Operation. Retrieved May 31, 2019.  url: https://www.secureworks.com/research/dridex-bugat-v5-botnet-takeover-operation     source_name: Imperva DDoS for Hire  description: Imperva. (n.d.). Booters, Stressers and DDoSers. Retrieved October 4, 2020.  url: https://www.imperva.com/learn/ddos/booters-stressers-ddosers/     source_name: Norton Botnet  description: Norton. (n.d.). What is a botnet?. Retrieved October 4, 2020.  url: https://us.norton.com/internetsecurity-malware-what-is-a-botnet.html     