The hidden work of a compromised computer

October 13, 2026

A computer can continue to operate normally while an attacker uses it for other purposes. This is how many botnets work: networks of compromised devices used to launch attacks, distribute fraud or create new avenues of access without the user noticing.

During the working day, someone may open their laptop, check their email and use it for hours without noticing any obvious signs of unusual activity. Meanwhile, software installed without the user's knowledge may be receiving instructions over the internet and using some of the computer's processing power and network connection to carry out tasks the user has not authorised. To the user, everything appears to be working normally; to the attacker, that computer has already become part of an infrastructure they can use.

⚠️This hidden activity does not always produce noticeable signs. A slow computer or unstable connection can have many possible causes, so these indicators should not be interpreted in isolation. The risk is confirmed when an attacker is able to use the computer to generate traffic, execute commands or facilitate further access.

How a computer starts working for an attacker

A botnet brings together devices on which an attacker has gained the ability to execute commands remotely. Botnets can include computers, mobile phones, routers, cameras and other connected devices. In our article Name the malware you have, and I'll tell you which botnet you belong to, we explained how malicious software, or malware, maintains communication with command-and-control infrastructure, known as C2, and receives instructions from whoever operates the botnet.

The value of a botnet lies in coordination. A single compromised device may have limited impact, but thousands of devices distributed across different countries and networks make it possible to distribute tasks and make it harder to identify a single source. Each device contributes processing power, connectivity or access to particular data and services.

⚠️ Not all botnets have the same capabilities. The malware used to control a router and generate attack traffic does not necessarily have the ability to read passwords stored on a laptop. Other malware families are designed to steal information or install additional malicious payloads. The specific risk depends on the device, its permissions and the code being used.

In a botnet, a device is valuable because of its connectivity, processing capacity and the actions that can be carried out remotely.

When someone else suffers the visible damage: botnets and DDoS

One of the ways a botnet can be used is to launch a distributed denial-of-service attack, or DDoS. An attacker can use large numbers of devices to send traffic towards a service or network until its operation is degraded or legitimate users are unable to access it. The visible damage appears on the website, application or connection of the organisation being attacked, while the devices generating some of that traffic may belong to people who are unaware that they are involved.

In a DDoS attack, traffic volume matters, but it does not explain the impact on its own. As we explained when analysing the availability of digital services under DDoS attack, an attack can saturate the connection, exhaust the capacity of systems handling communications or overload an application. The response needs to address the point of congestion: a firewall positioned behind a saturated link cannot, by itself, restore that link's capacity.

Traffic can also be distributed across many addresses within the same network. In a carpet-bombing DDoS attack, each destination receives a relatively low volume of traffic, but the combined effect degrades connectivity across the network as a whole. In these cases, looking at a single IP address can hide the true impact of the attack.

⚠️ A botnet is one possible infrastructure for launching a DDoS attack, but not all DDoS attacks originate from infected devices. In addition, protecting the service receiving the traffic does not remove the compromise from the devices generating it. These are related issues, but they require different measures.

A compromised device can take part in an attack even when another service is the visible target.

Beyond DDoS: credentials, sessions and footholds

Botnets are not used only for DDoS attacks. Depending on the malware's capabilities, a compromised device may distribute unsolicited messages (spam), download additional malware, collect information or provide the attacker with a foothold from which to move further. Our previous article on botnets describes, for example, the theft of credentials and session cookies and the potential impact on access to corporate systems.

A device being part of a botnet does not automatically mean that its data has been stolen, that the company has been breached or that every possible risk has materialised. However, if that device also accesses corporate email, business applications or a VPN, it is important to investigate which permissions and sessions may have been exposed.

⚠️ That review should not be limited to what is stored on the device. In some cases, the attacker is looking for information; in others, connectivity, an identity from which to send messages or an entry point that can be exploited later.

A compromised device can give an attacker data, connectivity, identity or access.

Indicators, investigation and response to a possible infection

Common infection vectors

The source of an infection usually depends on the type of device and its level of exposure:

On a computer, infection may occur through a malicious download, an unpatched vulnerability or an untrusted application.
On routers, cameras and other internet-exposed devices, the risk is often associated with default passwords, insecure configurations, unnecessary exposed services or outdated firmware.

Signs that warrant investigation

There is no single indicator that can reliably diagnose botnet activity. Unusual network usage, configuration changes or abnormal performance justify investigating the device, but they may have other explanations; equally, the absence of these signs does not rule out an infection.

An initial review should combine updating, scanning and access checks:

Update the operating system, applications and, where applicable, device firmware using official sources or the manufacturer's website.
Scan the computer using trusted security tools and review the accounts accessed from it, particularly if corporate credentials have been used.
For routers and cameras, check the configuration, review whether manufacturer updates are available and, if a reset is required, follow the manufacturer's instructions and avoid default credentials.

Investigation in enterprise environments

In enterprise environments, investigations should correlate technical, operational and human signals:

Device telemetry, network connections, DNS logs and security alerts can help identify unknown processes, persistent communications with malicious infrastructure or outbound traffic that does not match the expected function of the asset.
Users, support teams and security teams need clear criteria for escalating anomalous behaviour or signals that fall outside expected usage patterns.
On compatible devices or endpoints, an EDR tool can support isolation and analysis; for many IoT components, visibility needs to come from the network rather than from the device itself.

⚠️ Before closing the incident, the investigation should determine which devices are affected and check whether corporate credentials or access mechanisms have been used.

Reducing the risk of a device being recruited into a botnet

To reduce exposure to risk, it is important to know which devices are connected and which are accessible from the internet. Keeping systems, applications and firmware up to date, disabling unused services and changing default credentials reduces opportunities for compromise.

In a business environment, asset inventory also helps identify devices that have fallen outside normal maintenance cycles, such as cameras or routers installed years ago.

When a compromise is confirmed, the priority is to isolate the device and report the incident to the responsible team. The next step is to reconstruct the attacker's activity and restore the asset securely, following the manufacturer's guidance in the case of an IoT device. If the device has been used to access corporate services, those accesses should also be reviewed, potentially exposed sessions terminated and affected credentials changed from a trusted environment.

⚠️ A compromised device can continue to appear normal while a third party exploits its connection, processing capacity or access.

The investigation should therefore establish which actions were carried out from the device and whether they affected other devices, services or people. That is the computer's other job, the one that never appears on its screen.

______