Abstract
Botnets and Distributed Denial of Service (DDoS) attacks represent one of the most persistent and damaging categories of cyber threat to the European Union's critical infrastructure, essential services, and digital economy. A botnet, a network of compromised devices remotely controlled by a malicious actor, can be weaponised to launch DDoS attacks that overwhelm the target's network capacity, rendering essential services unavailable. The scale and sophistication of these attacks have grown exponentially with the proliferation of Internet of Things (IoT) devices, many of which lack basic security protections and are readily conscripted into botnets. This article evaluates the EU's regulatory response to botnet and DDoS threats, focusing on the original NIS Directive (2016/1148), the revised NIS 2 Directive (2022/2555), the Cyber Resilience Act (Regulation (EU) 2024/2847), and the Cybersecurity Act (Regulation (EU) 2019/881). It analyses the enforcement mechanisms, incident reporting obligations, and cross-border cooperation frameworks established by these instruments, and evaluates their effectiveness against the evolving threat landscape. Drawing upon case studies, including the Mirai botnet attack of 2016, the attacks on Estonian infrastructure in 2007, and the DDoS campaigns targeting EU institutions in 2023, the article identifies gaps in the current regulatory framework and proposes enhanced directives for critical infrastructure protection, including mandatory IoT security standards, improved threat intelligence sharing, and the harmonisation of national cybersecurity enforcement across Member States.
Keywords: botnets; DDoS attacks; NIS Directive; NIS 2; cybersecurity; critical infrastructure; IoT security; Cyber Resilience Act; incident reporting; EU cybersecurity law
1. Introduction
The security of the European Union's digital infrastructure is a precondition for the functioning of its single market, the delivery of its essential services, and the exercise of the fundamental rights of its citizens. Cyberattacks that disrupt energy systems, healthcare networks, financial services, transportation systems, or democratic institutions threaten not merely commercial interests but the basic capacity of the state to serve its population.
Among the most prevalent and destructive forms of cyberattack are those conducted through botnets. A botnet is a network of internet-connected devices, computers, servers, routers, cameras, smart appliances, that have been compromised by malware and placed under the remote control of a malicious actor (the "botmaster"). The compromised devices, or "bots", can be directed to perform a variety of malicious activities, including spam distribution, credential theft, cryptomining, and, most destructively, Distributed Denial of Service (DDoS) attacks.
A DDoS attack employs the combined network capacity of thousands or millions of botnet devices to flood a target server or network with traffic, overwhelming its capacity to process legitimate requests and rendering it unavailable to users. The consequences of a successful DDoS attack on critical infrastructure can be severe: hospitals unable to access patient records, financial institutions unable to process transactions, energy systems unable to manage grid operations, and government services unable to respond to citizen needs.
This article examines the EU's regulatory response to botnet and DDoS threats. Section 2 provides a technical overview of botnets and DDoS attacks. Section 3 analyses the EU regulatory framework. Section 4 examines enforcement mechanisms and case law. Section 5 identifies gaps in the current framework. Section 6 proposes reforms. Section 7 concludes.
2. Botnets and DDoS Attacks: A Technical Overview
2.1 Botnet Architecture
Modern botnets employ several architectural models. Traditional botnets use a centralised command-and-control (C2) architecture, in which the botmaster communicates with the compromised devices through a central server or a small number of servers. More sophisticated botnets use peer-to-peer (P2P) architectures, in which the bots communicate with each other without a central server, making the botnet more resilient to takedown efforts. The most advanced botnets use domain generation algorithms (DGAs) that dynamically generate new C2 domain names, frustrating efforts to block communications between the botmaster and the bots.
2.2 The IoT Vulnerability
The proliferation of Internet of Things devices has dramatically expanded the attack surface available to botnet operators. IoT devices, including smart cameras, routers, home appliances, industrial sensors, and medical devices, frequently ship with default credentials, lack mechanisms for firmware updates, and do not implement basic security measures such as encryption or access control. The Mirai botnet, which emerged in 2016, demonstrated the devastating potential of IoT-based botnets. Mirai compromised hundreds of thousands of IoT devices by scanning for devices using factory-default usernames and passwords, and used the resulting botnet to launch DDoS attacks that reached traffic volumes exceeding one terabit per second, disrupting major internet services including DNS provider Dyn, which caused outages for services including Twitter, Netflix, and Reddit.
2.3 DDoS Attack Vectors
DDoS attacks employ several technical vectors. Volumetric attacks flood the target with traffic, consuming bandwidth. Protocol attacks exploit weaknesses in network protocols (such as SYN floods and Ping of Death) to consume server resources. Application-layer attacks target specific applications or services (such as HTTP flood attacks that overwhelm web servers with seemingly legitimate requests). Modern DDoS attacks frequently combine multiple vectors in multi-vector campaigns that are more difficult to mitigate than single-vector attacks.
2.4 Scale of the Threat
The European Union Agency for Cybersecurity (ENISA) has consistently identified DDoS attacks as one of the top cyber threats to the EU. The ENISA Threat Landscape Report 2023 documented a significant increase in both the frequency and intensity of DDoS attacks targeting EU entities, with attacks increasingly directed at public sector organisations, healthcare providers, and financial institutions. The report noted that the geopolitical context, including the conflict in Ukraine, has contributed to a surge in politically motivated DDoS campaigns targeting EU Member State governments and institutions.
3. The EU Regulatory Framework
3.1 The Original NIS Directive (2016/1148)
The Directive on Security of Network and Information Systems (NIS Directive), adopted in 2016, was the first EU-wide cybersecurity legislation. The Directive required Member States to adopt national cybersecurity strategies, establish national competent authorities and Computer Security Incident Response Teams (CSIRTs), and impose security and incident reporting obligations on two categories of entities: operators of essential services (OES) in sectors including energy, transport, banking, financial market infrastructure, health, drinking water supply, and digital infrastructure; and digital service providers (DSPs) including online marketplaces, search engines, and cloud computing services.
The NIS Directive's effectiveness was limited by several factors. The identification of operators of essential services was left to Member States, resulting in significant divergences in the scope of the Directive's application across the Union. The security requirements were formulated in general terms, leaving Member States with broad discretion in their implementation. The incident reporting thresholds and procedures varied across Member States, complicating cross-border incident response. And the enforcement mechanisms were weak, with limited penalties for non-compliance.
3.2 The NIS 2 Directive (2022/2555)
The NIS 2 Directive, adopted in 2022 and applicable from October 2024, represents a substantial strengthening of the EU's cybersecurity regulatory framework. NIS 2 expands the scope of the Directive to cover a significantly broader range of sectors and entities, including public administration, space, wastewater, food production and distribution, manufacturing of critical products, postal and courier services, and waste management. It replaces the OES/DSP distinction with a new classification of "essential entities" and "important entities", determined by sector and size criteria rather than individual Member State identification.
NIS 2 introduces more prescriptive security requirements, including specific obligations for risk analysis and information system security policies, incident handling, business continuity and crisis management, supply chain security, and the use of cryptography and encryption. The Directive imposes enhanced incident reporting obligations, requiring entities to submit an initial notification to the competent authority within 24 hours of becoming aware of a significant incident, followed by a detailed report within 72 hours.
Critically, NIS 2 introduces harmonised enforcement provisions, including administrative fines of up to EUR 10 million or 2% of global annual turnover for essential entities, and up to EUR 7 million or 1.4% of global annual turnover for important entities. The Directive also introduces personal accountability provisions, enabling competent authorities to hold management bodies personally liable for failures to comply with cybersecurity obligations.
3.3 The Cyber Resilience Act
The Cyber Resilience Act (Regulation (EU) 2024/2847), adopted in 2024, addresses the cybersecurity of products with digital elements placed on the EU market. The Act imposes cybersecurity requirements on manufacturers, importers, and distributors of connected devices, including IoT devices, requiring them to ensure that products are designed, developed, and produced with appropriate levels of cybersecurity. Manufacturers must provide security updates for the expected product lifetime, document and address known vulnerabilities, and implement secure-by-default configurations.
The Cyber Resilience Act directly addresses the IoT vulnerability that has fuelled the growth of botnets. By requiring that connected devices ship with secure-by-default configurations, unique credentials, and mechanisms for security updates, the Act aims to reduce the number of devices that can be compromised and conscripted into botnets.
3.4 The Cybersecurity Act (2019/881)
The Cybersecurity Act establishes the EU cybersecurity certification framework and strengthens the mandate of ENISA. The certification framework enables the development of EU-wide cybersecurity certification schemes for ICT products, services, and processes, providing a common basis for assessing the security of digital products across the single market. ENISA's enhanced mandate includes the development of EU cybersecurity strategies, the facilitation of cross-border incident response, and the provision of technical assistance to Member States.
4. Enforcement and Case Law
4.1 The Estonian Cyber Attacks (2007)
The 2007 cyberattacks on Estonia represent one of the earliest and most significant state-linked DDoS campaigns targeting EU infrastructure. Following the relocation of a Soviet-era war memorial in Tallinn, Estonian government websites, banks, media outlets, and critical infrastructure were subjected to coordinated DDoS attacks that disrupted essential services for several weeks. The attacks are widely attributed to Russian-linked actors, though formal attribution remains contested. The Estonian incident was a catalyst for the development of EU cybersecurity policy and the establishment of the NATO Cooperative Cyber Defence Centre of Excellence in Tallinn.
4.2 The Mirai Botnet (2016)
The Mirai botnet demonstrated the scale of the IoT security problem. By exploiting default credentials on consumer IoT devices, Mirai's operators assembled a botnet capable of launching DDoS attacks of unprecedented volume. The attack on Dyn, a major DNS provider, caused widespread internet outages across Europe and North America. Three individuals were subsequently convicted in the United States for creating and operating the Mirai botnet, in what was one of the first significant criminal prosecutions of botnet operators.
4.3 EU Institutional Attacks (2023)
In 2023, the European Parliament, the European Commission, and several EU agencies were targeted by DDoS attacks attributed to pro-Russian hacktivist groups. The attacks, whilst not causing lasting damage, demonstrated the vulnerability of EU institutions to politically motivated cyber campaigns and underscored the need for enhanced cyber resilience at the institutional level.
4.4 The Directive on Attacks Against Information Systems
Directive 2013/40/EU on attacks against information systems criminalises several forms of cybercrime relevant to botnet and DDoS operations, including illegal access to information systems, illegal system interference, illegal data interference, and the use of tools for committing such offences. The Directive requires Member States to ensure that these offences are punishable by effective, proportionate, and dissuasive criminal penalties, and provides for enhanced penalties where the offences are committed through the use of a botnet.
5. Gaps in the Current Framework
5.1 IoT Security Enforcement
The Cyber Resilience Act addresses IoT security at the product level, but its effectiveness depends on enforcement capacity and the pace of market transition. The installed base of insecure IoT devices is vast, and these devices may remain in use for years after the Act's requirements take effect. The regulatory framework does not adequately address the challenge of legacy devices that cannot be updated and that will continue to be vulnerable to botnet recruitment.
5.2 Attribution and Cross-Border Enforcement
The attribution of cyberattacks to specific actors, particularly state-linked actors, remains one of the most significant challenges in cybersecurity enforcement. DDoS attacks conducted through botnets composed of devices distributed across multiple jurisdictions create complex cross-border enforcement challenges that the NIS 2 Directive's cooperation frameworks have not fully resolved.
5.3 Threat Intelligence Sharing
The effectiveness of cybersecurity defence depends critically on the timely sharing of threat intelligence between public and private sector entities. Whilst NIS 2 and the Cybersecurity Act promote information sharing, the practical implementation of threat intelligence sharing remains uneven across Member States, and private sector entities remain reluctant to share information about incidents and vulnerabilities due to concerns about liability, competitive sensitivity, and reputational risk.
6. Proposals for Enhanced Protection
First, mandatory end-of-life security management for IoT devices. Manufacturers should be required to implement mechanisms for the secure decommissioning of IoT devices that have reached end of life, including the revocation of network credentials and the notification of users of the security risks of continued use.
Second, enhanced cross-border enforcement cooperation. The EU should establish a dedicated cyber enforcement coordination mechanism, building upon the existing CSIRT network, to facilitate the rapid attribution and prosecution of botnet operations that span multiple jurisdictions.
Third, mandatory threat intelligence sharing. Essential and important entities under NIS 2 should be required, not merely encouraged, to share threat intelligence with national competent authorities and ENISA, with appropriate legal protections for entities that share information in good faith.
Fourth, DDoS resilience standards for critical infrastructure. The EU should develop specific DDoS resilience standards for operators of essential services, requiring the implementation of DDoS mitigation capabilities (traffic filtering, rate limiting, anycast distribution) as a condition of compliance with NIS 2 security requirements.
7. Conclusion
Botnets and DDoS attacks remain among the most significant cyber threats to the EU's critical infrastructure and essential services. The EU's regulatory framework, strengthened significantly by NIS 2, the Cyber Resilience Act, and the Cybersecurity Act, provides a comprehensive foundation for cybersecurity governance. However, gaps remain in the areas of IoT legacy device management, cross-border enforcement, threat intelligence sharing, and DDoS resilience standards. Addressing these gaps is essential to ensuring that the EU's cybersecurity framework keeps pace with a threat landscape that is evolving in scale, sophistication, and geopolitical significance.
Bibliography
ENISA, Botnet: Detection, Measurement, Disinfection and Defence (2011)
ENISA, Threat Landscape 2023 (2023)
Kolias C and others, 'DDoS in the IoT: Mirai and Other Botnets' (2017) 50 Computer 80
Mirkovic J and Reiher P, 'A Taxonomy of DDoS Attack and DDoS Defense Mechanisms' (2004) 34 ACM SIGCOMM Computer Communication Review 39
Ottis R, 'Analysis of the 2007 Cyber Attacks Against Estonia' (2008) ECIW 2008
Back to contents ↑ 
