The emergence of cyberspace has been followed by increasingly unpredictable threats to cybersecurity, including Botnets, which have been frequently exploited in cyber-criminal activities affecting dozens or hundreds of States at once. In existing scholarship, many reasons have informed growing support for the promise of ‘due diligence’ obligations in regulating transboundary cyber operations. We affirm this position through a study of the specific context of Botnets, although bringing much-needed caution and complexity to the discourse. We offer a comprehensive account of the standard of conduct expected of States in detecting, mitigating and preventing Botnet-linked harms under due diligence; as well as to pursue cyber capacity building toward discharging these obligations. In so doing, we problematize and elaborate on the nature of due diligence as an obligation of conduct, therefore accounting for differential State capacities against Botnet-linked harms. The paper involves attempts to unpack a coherent conception of due diligence, appreciating the spectrum of obligations that it demands, and demonstrating these nuances through an appraisal of good practices adopted by States and private actors against Botnets. Consequently, we provide a unique holistic account of how States and their law enforcement could practically understand the conduct expected of them when faced with transboundary Botnets on a case-to-case basis. In the end, while underscoring potential dilemmas within this legal regime that may be faced by target States, as also its unresolved questions, we submit that due diligence is indeed the most appropriate candidate to act as a legal arsenal against transboundary Botnets.