Acquire Infrastructure: Botnet
- ID
- T1583.005
- Tactics
- TA0042 Resource Development
- Sub-technique of
- T1583 Acquire Infrastructure
- Platforms
- PRE
- Source
- attack.mitre.org
- MITRE last modified
- 25 Oct 2025
Adversaries may buy, lease, or rent a network of compromised systems that can be used during targeting. A botnet is a network of compromised systems that can be instructed to perform coordinated tasks.[1] Adversaries may purchase a subscription to use an existing botnet from a booter/stresser service.
Internet-facing edge devices and related network appliances that are end-of-life (EOL) and unsupported by their manufacturers are commonly acquired for botnet activities. Adversaries may lease operational relay box (ORB) networks – consisting of virtual private servers (VPS), small office/home office (SOHO) routers, or Internet of Things (IoT) devices – to serve as a botnet.[2]
With a botnet at their disposal, adversaries may perform follow-on activity such as large-scale Phishing or Distributed Denial of Service (DDoS).[3][4][5][6] Acquired botnets may also be used to support Command and Control activity, such as Hide Infrastructure through an established Proxy network.
Detection
- DET0837 Detection of Botnet
Mitigations (1)
- M1056 Pre-compromise
This technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls.