Well, if I were to build my own botnet (hypothetically), I could do it with almost zero costs. I could also expand it for free - free as in it doesn't cost money, but it does cost time. Wait for a new remote code exec vuln with a PoC to come out, then make a little program to randomly scan IPs and try the PoC against the service. If successful, I can have it do several things at the point: If I wish to put in a lot of time writing it, and spend less responding to alerts, I can code in some common methods of privilege escalation if I need it. Otherwise, I can have it alert me on a successful exploitation for manual processing. If my remote control software doesn't require root, then I do neither, adding the machine to my botnet and moving on. I can also do the usual shit they do, spread fake torrents that morons download and run, etc. All of these things grow my botnet, which brings in revenue, and they don't cost me a dime.
If I have money to spend, that opens up further options: want to be lazy, I can hire someone to do it for me, or if I want to rapidly grow, I could drop a good amount of money on a zero-day. The former is rather pointless if I have the skill, unless I am very time constrained, but the latter is a one-time investment that is a lot smarter than buying bots. I can also deploy more techniques, free or otherwise, to expand my botnet whenever I have the time and/or money.
So, you're saying that botnet owners aren't making money - pray tell, where is the mined XMR going? Because if I can set up a small botnet and grow it with pretty much zero expenses, then ANY XMR I mine is profit - monetarily, anyway - I suppose I'd still be looking for an ROI on my time.
Now, while I don't know the details of the operations run by the two people I know, I know that this is possible. Therefore, anyone with a brain is going to be looking at options with the least expenses.
Note that I say "almost no expenses." Unless you make everything from scratch, which isn't usually feasible, you will need to pay for SOME things. Not exploits, you can use public ones - plenty of people are too slow or lazy to update - if you're fast, you should get plenty. No, what you'll probably have to buy is the use of a crypter for your software, otherwise it will soon get flagged and you'll end up losing bots.
Thank you for the great answer. I agree, it's not universally applicable to speak about botnets in terms of ROI, unless you probably rent a botnet, not own one.
Anyway, since there are opportunity costs for botnet owners, there is still a parity between the profit and the potential profit from alternative usage. This implies that my general considerations should hold. If it is more profitable to mine XMR over doing some other nice things with your botnet, you are going to mine. The situation may still change in case exchange rate decreases significantly, or block reward gets smaller.
And what's more, if the costs are virtually zero, it is profitable to sell XMR at any price (which is exactly what you've said). This only reinforces my idea that the selling side is fundamentally huge for XMR since botnet operators don't even have to earn a margin. Your example only moves the break-even point down to zero (while I assumed to be somewhere higher). Therefore, you only prove that it is unlikely that the coin is going to grow until the problem is resolved.
Hello Mr. Bytecoin,
your guess is plain wrong, you might want to talk to some poolops to know that the most mining is still from normal miners and cloudminers.
On a second note it makes no difference for a botnet to mine a GPU mineable coin or Monero, you can easily deploy cudaminer and cgminer there without issues.
Take a look at this Litecoin Botnet:
http://www.coindesk.com/facebook-breaks-cryptocurrency-mining-botnet-lecpetex/Using a Botnet for that kinda stuff, well their are far better way to monetize them...
Hello Mr. Monero,
I've been talking to some. EC2 and botnets are easy to identify. I know of at least 2 confirmed botnets: 4 MH/s (mentioned in your IRC channel by one of the poolops), and 700 KH/s (hopped on about a week ago and also discussed on the IRC). I do think that 4MH/s is the largest one, but in any case there should be way more of them. I've even stumbled upon a silent miner being sold on one of the related forums. So the issue should be large.
By the way, in case of EC2 my assumptions regarding costs and profit (non-applicable to botnets in general) may actually hold. What is going to happen to XMR when the EC2 operators switch to a fresher CPU-mined currency when they see no further economic rationale to stay with XMR?
" 
