>>9
You should make your targets and your controlling host all nodes on the Tor network.
The targets should not be nodes on Tor, because a) it's very difficult to have a bot automatically configure routers to forward incoming connections on Tor ports to the host; b) running a node chews up a lot of bandwidth, which you could be using to do productive things with your bots.
Rather, you should make only the controlling server a Tor node with a hidden IRC service, and have the bots connect to it. They don't need to be nodes to do this. This way connectivity issues lie entirely in the bots themselves, so your server doesn't have to do shit all but run the IRC channel and dish out instructions. Integrate the Tor source to do this right into the bot itself so you don't need any external resources to have the bots directly access Tor.
If you don't want to run a hidden service, you can use one of the several public IRC hidden services already running. You don't need to worry about channel permissions; instead, whenever a bot joins the channel, have the controller message them and confirm its identity as the controller using a handshaking system similar to that which Tor hidden services use to identify themselves. That way no one can fake being the controller, regardless of whether they steal your nick or your channel. Come up with a deterministic algorithm to generate plausible channel names (from a tech dictionary for example) in case the IRC admin decide to ban/lock/mute your control channel; have the bots wait a random amount of time (up to half a day perhaps) before joining the next channel in the algorithm, to prevent it from being immediately discovered. Have a list of backup networks to join in case the main network goes down, and have them fallback on Freenode (which your controller can access through the onion) in case no Tor IRC networks survive.
This way you can fully control your bots without ever even running a server.
Botnets are fucking cool. I should not be talking about this; it gives me ideas...
>>1
You say distribution will not be a concern. How so? Are you planning to walk around with a flash drive installing it on random computers or something? That's almost certainly a bad idea...