On July 25, 2025, during a penetration test at Horizon Financial Services in Chicago, Illinois,...

Smurf Attack

Distributed Reflection Denial-of-Service DRDoS

Botnet

Central Source Propagation

CA botnet is the most likely structure behind this attack because the scenario describes multiple compromised machines generating coordinated traffic under the direction of a central command-and-control server. In CEH-aligned terminology, a botnet is a collection of infected endpoints called bots or zombies that receive instructions from an attacker-controlled C2 infrastructure. Once commanded, these bots can simultaneously send large volumes of requests or packets toward a target, creating a distributed denial-of-service condition that overwhelms bandwidth, server resources, or application capacity and makes the service unavailable to legitimate users.Key clues strongly match botnet behavior. The traffic originates from many compromised systems rather than a single host, and it is “orchestrated through a central command-and-control server,” which is the defining control mechanism of botnets. The mention of devices “recruited via malicious links on social media” aligns with common bot recruitment vectors covered in CEH material, including drive-by downloads, phishing, malicious attachments, and social engineering that installs malware and enrolls the device into the botnet.The other options do not fit as precisely. A Smurf attack is an older amplification technique using ICMP echo requests sent to a broadcast address with a spoofed source IP, not typically described as being centrally controlled infected devices. A DRDoS relies on reflection and amplification through third-party servers such as DNS or NTP, where traffic comes from reflectors rather than infected endpoints under direct control. “Central Source Propagation” is not the standard term for this coordinated DDoS structure. Therefore, the correct answer is Botnet.