You are working as a Security Analyst in a company XYZ that owns the whole subnet range of 23.0.0.0/8 and 192.168.0.0/8. While monitoring the data, you find a high number of outbound connections. You

A botnet is a network of malware-infected devices (bots) controlled by a threat actor through a command-and-control (C&C) server. The scenario - many internal IPs compromised and funneling outbound traffic to one blacklisted public IP - matches the C&C beacon pattern exactly, confirming a botnet attack.

Spear phishing is a targeted social engineering technique delivered via email to trick specific individuals; it describes an initial attack vector, not an ongoing pattern of outbound network connections from multiple hosts.

Advanced Persistent Threats describe a stealthy, long-duration intrusion campaign by sophisticated actors; the term characterizes the attacker's methodology and persistence, not the specific network traffic pattern of many hosts beaconing one IP.

A rootkit is malware that conceals its presence on a single compromised host at the OS level; it does not explain a network-wide pattern of multiple systems communicating outbound to a single external address.