After looking at the Matrix rules for 5th it seems like botnets aren't really a possibility anymore as devices lose all the marks they have once they reboot. So if you had a network of fifty slave machines they'd all be clean as soon as someone restarted them. Even if that is an infrequent occurrence it still seems like with RAW you can't actually build a botnet anymore.

Though maybe you could edit a file in the device to tell it to switch to a different set of operating instructions once it got a certain signal. A kind of "sleeper zombie." It'd probably be a one-time use thing but it sounds plausible.

Standard hacking tricks aren't going to work here anymore.

If you hack into a device by placing marks onto it, the marks will only last until either that device, or your persona reboots. Considering once you take a single illegal action isn't only a mater of time until GOD comes and destroys you (if you don't reboot first) it removes the mark situation.

Spoofing can make it technically possible, but it's unlikely

First, you need to find the persona of the owner of the device you are targeting. I'm assuming the device isn't slaved to a host. Then you need to place a mark on that persona. Then you can spoof a command to the device to have it offer a legitimate 3 marks (with automatic re-offer on reboot) to you (or anyone else with a persona of your choice.)

However, there is no reason to do this. The devices aren't useful for anything unless they have a persona with which to take actions. Even if they have a persona, such as an Agent program, they can't help you with cyber-combat or hacking unless they have Attack and Sleaze ratings. Very few devices can run an Agent program, and to do so, you'd have to use more spoof commands to make the orders seem to come from the owner.

In other words, the only thing worth botnetting would be cyberdecks, and no decker or spider worth their salt will miss the whole three marks and an agent program thing.

Your better bet to do something similar is to build one yourself by getting a lot of cheap decks (ha!) and loading agent programs on them yourself. This would get you a swarm of low grade hack-enabled agent personas to order around, but good luck getting them into a host.

You can always get those add on commlink dongles that give you sleaze or attack. I wonder can you slave a commlink with an attack dongle to a commlink with a sleaze dongle and get yourself that "cheap deck" you're talking about BlackJaw.

Commlinks can't run agent programs, or cyber-programs at all, so it won't work. You need an actual deck, or find a way to add Sleaze/Attack to Drone or RCC, as those can run an Agent.

You can also run into problems with Master/Slave status and generating personas, so that isn't a way around deck prices. (If I remember correctly. This is esoterica and developer commentary, not all spelled out in the books proper.)

Incorrect - You can add a program carrier Module (not sure if that is the name for the mod, but it is in Data Trails) to a comlink and bada bing bada boom, Agent capable Conlink.

There is even a Comlink with an already included Agent in Datatrails
and you can also add a dongle with either Sleaze or Attack ( but I heard its quite expensive)
But don't ask me the specifics, go browse the Datatrails

HokaHey
Medicineman

Still cheaper than a deck with the same level of attack