Researchers are mapping botnet command-and-control infrastructure with decoy devices and AI, publishing indicators and automating edge filtering to enable proactive defense instead of waiting for attacks to occur.

While takedowns of botnets like RapperBot and Aisuru have reduced some capabilities, the threat persists, and 2026 saw a rise in high-capacity attacks surpassing 1 Tbps.

DDoS threats have shifted from enterprise targets to country-scale risks, driven by compromised consumer devices and residential proxy networks.

A collaborative effort among service providers, vendors, manufacturers, law enforcement, and researchers is essential to counter botnets, with a sustained emphasis on listening to threat signals and acting on them.

Blocking botnet C2 traffic at the network edge can stop infected devices from receiving instructions, weakening botnets even if the devices stay compromised.

There is a notable daily surge in compromised devices, with botnets issuing floods and around 28 distinct botnets actively directing attacks.

The EU Cyber Resilience Act mandates strict vulnerability reporting and ongoing security updates, shifting responsibility for security to manufacturers.

Residential proxies enable enormous botnet capacity by routing traffic through home devices, a market with legitimate uses and a growing gray market supplying SDKs and preloaded firmware.

A proactive defense stance treats compromised devices as early indicators of future attacks, shifting from mitigation to prevention.