Yeah both really. The botnets usually act as C&C for tools that create outbound DDoS attacks and exfil user data. They also create jump-off proxy points to mask their location. IRC is a very handy way to control large numbers of attack bots.