A zombie is a compromised, internet-connected host that an attacker controls remotely, the basic building block of the botnets whose traffic a thorough DDoS test is designed to emulate. Malware conscripts the machine (a PC, server, router, or IoT device) and connects it to a command-and-control channel, then waits for instructions while the owner usually notices nothing and the device keeps performing its normal function. On command, thousands or millions of zombies send traffic at a single target at once, which is what makes a distributed denial-of-service attack distributed: the flood arrives from a vast spread of real, geographically scattered IP addresses rather than one source. A collection of zombies under one controller is a botnet; a single zombie is sometimes called a bot or a drone.
How a device becomes a zombie
A host is conscripted the same way any machine is compromised: an unpatched vulnerability, a weak or default credential, a malicious download, or a wormable exploit that spreads on its own. Once the malware lands it makes itself persistent and quietly registers with a command-and-control channel, then does nothing conspicuous. That dormancy is deliberate. A zombie is more valuable the longer it stays unnoticed, so well-built bot malware throttles its own footprint, keeps the device working normally, and waits. The owner sees a slightly slower router or a warm IoT camera, not an attack tool. Only when the operator issues a command does the fleet wake and generate traffic in unison.
IoT devices make especially durable zombies. They ship with default passwords, rarely receive firmware updates, run for years, and have no screen or owner watching for trouble, which is why worms like Mirai assembled enormous fleets from cameras and home routers. The same weaknesses that make a device cheap make it a reliable, long-lived recruit, so the population of available zombies is large and constantly renewed as new insecure devices come online.
Zombie versus reflector
Both flood a victim from third-party addresses, but the mechanism differs, and the distinction matters for testing. A zombie is a compromised device under the attacker's control, running code that deliberately sends attack traffic. A reflector is an uncompromised device that is merely answering a forged request, tricked into aiming its reply at a spoofed victim. A zombie floods you on purpose; a reflector floods you by accident. The same device fleet can serve both roles, which is why volumetric-vector coverage cannot stop at one attack shape: an operator who loses a botnet's direct-flood capability can pivot to reflection using the very same insecure devices, this time as unwitting amplifiers rather than conscripts.
Why the fleet is the threat
The danger of a zombie is not the single device but the scale and legitimacy of the pool behind it. Because zombies are ordinary, previously-legitimate machines, their traffic carries real source IPs from residential and mobile ranges. That defeats naive source blocking and IP reputation at scale, because the addresses belong to real subscribers a defender cannot simply blacklist without cutting off genuine customers. Spread across tens of thousands of such hosts, even a modest per-device request rate composes into a flood that no single-source rate limit will catch, since no one address sends enough to trip a threshold.
Why it matters in DDoS testing
A credible DDoS test has to reproduce that distributed reality, not approximate it from one machine. A test that models a botnet uses many distributed sources so it exercises the problem defenders actually face: separating conscripted hosts from real users without blocking the real users. A single-box load test, by contrast, arrives from one IP at high rate, which is the easiest possible thing to filter and tells you almost nothing about resilience against a real spread. That distributed source spread, and how it combines with the specific flood types a fleet can produce, is detailed in understanding DDoS attack vectors.