2007, Larry Chaffin, Craig Schiller, Anton Chuvakin, Infosecurity 2008 Threat AnalysisAfter securing the computer against antivirus tools, previous hackers, and detection by the user, the botherder might check to see what else might be here.
2009, John Hoopes, Virtualization for securityMost bots use a central C&C server for communicating with their botherder, and normally they use the standard IRC protocol for that purpose.
