Cyber-attack detection has become a basic component of all information processing systems, and once an attack is detected it may be possible to block or mitigate its effects. This paper addresses the use of a learning recurrent Random Neural Network (RNN) to build a lightweight detector for certain types of Botnet attacks on IoT systems. Its low computational cost based on a small 12-neuron recurrent architecture makes it particularly attractive for edge devices. The RNN can be trained off-line using a fast simplified gradient descent algorithm, and we show that it can lead to high detection rates of the order of 96%, with false alarm rates of a few percent.