instructions from the bot owner. This is typically done via an IRC
channel. The bot, when started, registers itself to the bot owner as
part of that person's botHerd. A botHerd is simply the name given to a
group of similar bots under the control of a single owner, or group of
owners. By establishing an outbound connection to the bot IRC channel,
bots can bypass many firewalls or similar controls where outbound
traffic is, unfortunately, typically allowed.
Bots are notorious for quickly implementing new vulnerability exploit
code, and since the botHerd owners have an established base of
attacking systems, the attack can easily look like a worm. An
instruction is issued in the controlling IRC channel and the bots
dutifully update themselves with whatever new attacks the bot owner has
coded. Then they'll typically resume their activities, be it spamming,
attacking or whatever the owner desires.