Computers become part of a zombie network through malicious software (malware) that is unknowingly installed by users or automatically installed through a security network's back door, or by exploiting Web browser vulnerabilities. The malware leaves specified networking ports open, allowing computer access by outside users. Zombie networks run similar types of malware that may be multiple networks operated by different criminal entities (cyber or otherwise).

Types of attacks perpetrated by a zombie network include denial of service attacks, adware, spyware, spam and click fraud.

The following steps, or a variation, are used to create zombie networks:

• A zombie network operator uses a bot to infect thousands of computers with worms or viruses that carry a deadly payload.
• The bot inside an infected computer logs on to an online server - usually IRC but sometimes Web.
• The zombie network operator leases zombie network services to a customer.
• The customer provides the zombie network operator with spam or any other material, which is run through the zombie network.