For the first time botnets have leapfrogged distributed denial-of-service (DDoS) attacks as the top operational threat to internet service providers (ISPs), new figures suggest.