1 Million Devices Infected? Real Botnet Scale

Yes, botnets with nearly 1 million infected devices have been documented, though the exact number constantly changes as devices are cleaned and new ones are added. This article explains how such large-scale infections happen, what the real-world impact looks like, and how you can check if your device might be part of one.

What Is a Botnet and How Does It Grow?

A botnet is a network of internet-connected devices that have been compromised by malware, allowing a remote attacker (the “botmaster”) to control them without the owners’ knowledge. Each infected device is a “bot” or “zombie.” Botnets grow through automated scanning and exploitation: malware probes the internet for vulnerable devices, infects them, and then uses those new bots to scan for more victims. This self-propagating cycle is why a botnet can balloon to nearly a million devices in weeks.

Common infection vectors include:

Brute-forcing weak passwords on services like SSH, Telnet, and remote desktop.
Exploiting unpatched software vulnerabilities in routers, web servers, and IoT devices.
Phishing emails that trick users into running malicious attachments or links.
Drive-by downloads from compromised websites.

Real Examples of Million-Device Botnets

Several botnets have reached or exceeded the 1 million mark. The Mirai botnet, first seen in 2016, infected an estimated 600,000 IoT devices at its peak, but later variants pushed that number higher. The Emotet botnet, primarily a Windows-based malware, controlled over 1 million machines at its height before law enforcement disrupted it in 2021. More recently, the Mozi botnet, which targeted IoT devices, was estimated to have infected over 1.5 million devices before its infrastructure was taken down in 2023.

These examples show that “nearly 1 million” is not an exaggeration—it’s a recurring reality for major botnets.

What Do Botmasters Do With Infected Devices?

Infected devices are used for various malicious purposes, often simultaneously:

DDoS attacks: Flooding websites or online services with traffic to take them offline. The Mirai botnet famously knocked large parts of the internet offline in 2016.
Spam email: Sending billions of phishing emails from compromised machines to evade spam filters.
Credential stuffing: Using the device’s IP address to automate login attempts on banking and shopping sites.
Cryptocurrency mining: Stealing CPU/GPU power to mine coins for the botmaster.
Proxy reselling: Selling access to the infected devices as a proxy network to hide other criminal activity.

How to Check if Your Device Is Infected

Most victims don’t know their device is part of a botnet. But there are signs to watch for:

Unusually high CPU or network usage (especially for IoT devices that normally idle).
Slow performance or frequent crashes.
Unusual outbound network traffic, often to unfamiliar IP addresses.
For routers: settings changed without your action, or the device becomes unresponsive.

You can also check your IP against public blacklists (like Spamhaus) or use network monitoring tools to see what your devices are communicating with. If you suspect an infection, disconnect the device from the internet, run a reputable antivirus scan, and change all passwords.

How to Protect Your Devices from Botnet Recruitment

Prevention is far easier than cleaning up an infection. Follow these steps:

Change default usernames and passwords on all devices, especially routers and IoT gadgets.
Keep all software and firmware updated—botnets exploit known vulnerabilities.
Disable remote access features (like SSH, Telnet, UPnP) if you don’t need them.
Use a firewall and only open necessary ports.
Be cautious with email attachments and links, even from known senders.
Segment your network: keep IoT devices on a separate Wi-Fi network from your main computers.

Common Misconceptions About Botnets

“Only computers get infected.” False—routers, IP cameras, smart TVs, and even refrigerators have been recruited into botnets. “My antivirus will catch everything.” Not always; some botnet malware is designed to hide from AV, and IoT devices often have no AV at all. “A botnet infection is harmless if I don’t notice it.” Wrong—your device can be used for illegal activity, and your bandwidth is consumed, potentially slowing your connection and raising your data usage.

Frequently Asked Questions

Can a botnet infect my smartphone?

Yes, Android devices are more commonly targeted than iPhones, but both can be infected via malicious apps or exploits. Symptoms include rapid battery drain, unusual data usage, and pop-up ads. Stick to official app stores and keep your OS updated.

How do botnets get taken down?

Law enforcement and security researchers work together to identify command-and-control (C2) servers and disrupt them. They may seize domains, arrest operators, or “sinkhole” traffic to prevent commands from reaching bots. This often only temporarily reduces the botnet, as the malware can be updated to use new C2 infrastructure.

Can I be held legally responsible if my device is part of a botnet?

In most jurisdictions, you won’t be held criminally liable if your device is unknowingly compromised. However, if your device is used to attack others, you could be contacted by your ISP or law enforcement, and you might be liable for damages in civil cases if you were negligent (e.g., left default passwords).

What is a DDoS attack and why is it so common?

DDoS (Distributed Denial of Service) attacks overwhelm a target with traffic from many devices. They’re common because they’re relatively easy to launch with a large botnet and can be offered as a “service” on the dark web. Even a small botnet of a few thousand devices can take down an unprotected website.

Is there a way to see if my IP is on a botnet blacklist?

Yes, you can use public services like Spamhaus Project’s IP checker or MXToolbox. If your IP is listed, it means your device (or someone on your network) has been sending spam or malicious traffic. You’ll need to clean the infection and then request delisting.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.

More cards in this drawer

The whole Numbers and Powers drawer →