I remember when some of the earlier botnets I was exposed to used IRC networks and private/hidden channels to provide command/control interfaces to the bots/zom

I remember when some of the earlier botnets I was exposed to used IRC networks and private/hidden channels to provide command/control interfaces to the bots/zombies/clients. In a lot of cases, the control mechanism had no redundancy (set to one specific network and/or server and channel). People passed around lots of executables during those days (naively trusting sources/friends) which usually had additional side-loading mechanisms for the bot (sometimes from an HTTP request, sometimes FTP). Used to grab these modified executables for plugins/game extensions/etc, sandbox them, and identify the control IRC networks, channels, passwords and have the networks shutdown the channels which essentially killed the botnet from further use. I imagine most the clients are far more resilient and sophisticated these days. I think the largest botnet I identified and 'shut down' (obviously with help from IRC network admins) had around a million clients on separate networks. Most of these were pushed on smaller relatively unknown/unpopular IRC networks where the admins somehow didn't notice tens of thousands of clients sitting idle on their network. It was always a bit enjoyable to pop in one of the private password protected control channels and start a conversation, catching someone completely off guard who didn't expect anyone to find their little control interface. I imagine most these were built off a known library which wasn't too sophisticated. Most people were humorously surprised.