Malware

What malware is

Malware (short for malicious software) is any program or code written to harm a computer, its data or its users: to steal information, damage or encrypt files, spy, take control of the system or use it to attack others. The word covers many different families. Security people sort them in two ways, and both matter for defense:

• How it spreads (the infection mechanism): does it need a person to run it, does it attach itself to other files, or does it move across the network on its own?
• What it does (the payload): encrypt files, steal passwords, show advertisements, hide other malware, or wait for commands.

One sample often combines several families: a trojan that installs spyware, a worm that delivers ransomware. Antivirus vendors give each sample a family name, but in practice you care about the behavior, because that decides what you must contain and clean up.

The main families

The table gives the families every starter and every Security+ or ISC2 Certified in Cybersecurity (CC) candidate should recognize. The glossary terms are explained in more detail below the table.

Viruses and worms

A computer virus inserts its code into another program or document, and runs whenever that host runs; it spreads when the infected file is copied, shared or emailed. A virus needs help from people. A worm does not: it is a standalone program that copies itself from computer to computer over the network, usually by exploiting a vulnerability in a service that listens for connections. That is why worms can infect thousands of systems within hours. WannaCry (2017) is the textbook example: a ransomware worm that spread through a flaw in the Server Message Block (SMB) file-sharing protocol of Windows, for which a patch had been available for about two months. Unpatched systems with SMB reachable were infected without anyone clicking anything.

Trojan horses

A trojan horse (trojan) is malware disguised as something useful — a free game, a "codec" to play a video, a cracked version of paid software, a fake browser update — that the victim installs willingly. Trojans do not copy themselves; their purpose is to get the attacker a foothold. A remote access trojan (RAT) gives the attacker full remote control, and a downloader or dropper fetches the real malware afterward.

Ransomware

Ransomware encrypts files (and often whole servers and backups) and demands payment, usually in cryptocurrency, for the decryption key. Modern ransomware attacks on organizations are rarely an automated infection; they are operations by people who first get in, spend days or weeks exploring the network, steal data, delete or encrypt the backups they can reach, and only then start the encryption — often at night or on a weekend. With double extortion the criminals also threaten to publish the stolen data, so good backups alone no longer remove the pressure. Ransomware is covered in its own section further down this page.

Spyware, keyloggers and infostealers

Spyware secretly collects information about a user and sends it to someone else. A keylogger records keystrokes, including passwords as they are typed. An infostealer grabs passwords saved in browsers, session cookies, cryptocurrency wallets and files in one go. Stolen session cookies are especially dangerous: they belong to an already logged-in session, so an attacker who replays them may get in without the password or the second factor. Stolen credentials from infostealers are traded on criminal markets and are a common starting point for later ransomware attacks.

Rootkits and bootkits

A rootkit is malware that hides itself and other malicious software by changing how the operating system reports files, processes and network connections — often at kernel level. Because the infected system lies to its own security tools, rootkits are hard to detect from inside the system; detection relies on scanning from outside (a boot from clean media) or on comparing what the system reports with what is really there. A bootkit goes one step lower and infects the boot process or firmware, so it runs before the operating system starts. Secure Boot helps against boot-loader bootkits by refusing unsigned boot code; firmware implants need firmware write protection and signed firmware updates, and may require reflashing or replacing the board. The safe response to a confirmed rootkit is to rebuild the system from known-good media, not to try to clean it.

Fileless malware

Fileless malware runs in memory rather than from a file on disk. It usually relies on living off the land: abusing legitimate tools already present — PowerShell, Windows Management Instrumentation (WMI), scripting engines. Because there is no malicious file to scan, signature-based antivirus has little to work with; detection depends on behavior: a word processor that starts PowerShell, which downloads and runs code, is suspicious whatever the files look like.

Botnets

A botnet is a network of infected devices (bots or zombies) that an attacker controls remotely through a command and control (C2) server. Botnets send spam, run distributed denial of service (DDoS) attacks, guess passwords on a large scale and mine cryptocurrency. IoT devices — cameras, routers, recorders — with default passwords and no updates are popular recruits; the Mirai botnet (2016) was built almost entirely from them. Connections to known C2 servers are a classic sign that a device has become a bot.

Logic bombs

A logic bomb is malicious code hidden inside legitimate software that does nothing until a condition is met: a date, or "my account no longer exists". They are typically planted by insiders, such as an administrator who expects to be fired. Defenses are organizational as much as technical: code review, separation of duties and prompt removal of access for leavers (see Access Control).

How infections happen

Malware needs a way in. Nearly all infections use one of these routes:

• Email attachments and links: an invoice, a shipping notice or a voicemail that is really an executable, a script or a document with a link to a malicious download. See Social Engineering and Phishing.
• Malicious downloads: cracked software, fake installers found through search advertisements, fake "update your browser" pages.
• Drive-by downloads: visiting a compromised or malicious website is enough when the browser or a plug-in has an unpatched vulnerability.
• Office macros: small programs inside documents. Microsoft now blocks macros in files downloaded from the internet by default (since 2022), which has made this route less common, but "enable content" prompts are still a warning sign.
• Removable media: Universal Serial Bus (USB) sticks that carry malware from one computer to another, or that are left in a parking lot on purpose. In environments with isolated networks, such as industrial control systems, this is one of the main routes in.
• Exploited vulnerabilities: services that are reachable from the internet — virtual private network (VPN) gateways, Remote Desktop Protocol (RDP), web applications, file transfer software — with a known, unpatched flaw. No user action is needed.
• Stolen or guessed credentials: not malware itself, but one of the most common ways ransomware operators get in before they deploy anything.

Signs of infection

Good malware tries to be invisible, so the absence of symptoms proves nothing. Still, these are reasons to report a device to the service desk or the security team:

• The computer is suddenly slow, the fan runs constantly, or the network is busy while nobody uses it (for example a bot or a cryptocurrency miner).
• Pop-ups, new browser toolbars, a changed home page or search engine.
• The antivirus or endpoint agent is switched off, or Windows Update and security settings cannot be changed.
• Files that cannot be opened, have a new extension, or a ransom note on the desktop.
• Friends or colleagues receive emails or messages from you that you did not send; accounts send unexpected password-reset or sign-in alerts.
• Unknown programs that start with the computer, new user accounts, or new scheduled tasks.

Defenses

Malware defense is a clear case of defense in depth: every layer stops some of it, and together they stop most of it. The controls that matter most:

• Patching: worms and drive-by downloads need an unpatched vulnerability. Patch internet-facing systems first and fast; see patch management and Vulnerability Management.
• Endpoint protection: antivirus finds known malware by its signature; endpoint detection and response (EDR) watches behavior, can isolate a device remotely and records what happened. See Endpoint Security.
• Least privilege: a user without administrator rights cannot install a driver or kernel rootkit unless the malware first exploits a privilege-escalation flaw, and much malware fails or stays contained. Use separate administrator accounts (see least privilege).
• Application allowlisting: only approved programs may run, so an unknown executable in the Downloads folder simply does not start.
• Email and web filtering: block dangerous attachment types (executables, scripts, disk images), scan links, and block known malicious websites.
• Backups that malware cannot reach: offline copies or immutable backups (which cannot be changed or deleted until a retention period ends). See the 3-2-1 rule in Backup and Recovery.
• User awareness: people who recognize phishing and report it quickly — without fear of blame — are a detection layer in themselves.
• Network segmentation: a worm or an attacker can only spread as far as the network lets them (see Network Security Basics).

Signatures versus behavior

Traditional antivirus compares files with a list of known-bad fingerprints, often cryptographic hashes. Threat intelligence feeds share such hashes as indicators of compromise (IOCs): observable traces of an attack, such as file hashes, domain names and Internet Protocol (IP) addresses, which a security operations center (SOC) watches for, as explained on Security Monitoring and the SOC. The sketch below shows both the strength and the weakness of hash matching. The "known bad" hashes are of harmless demo text.

import hashlib

# Indicators from a (fictional) threat intelligence feed: SHA-256 hashes
# of known-bad files. These are hashes of harmless demo text, not real malware.
KNOWN_BAD = {
    hashlib.sha256(b"demo sample: invoice macro dropper").hexdigest(): "Demo.Dropper.A",
    hashlib.sha256(b"demo sample: fake browser update").hexdigest(): "Demo.FakeUpdate.B",
}

# Files found in a user's Downloads folder (name, content).
downloads = [
    ("holiday-photos.zip", b"just some holiday photos"),
    ("Invoice_0815.docm", b"demo sample: invoice macro dropper"),
    ("browser-update.exe", b"demo sample: fake browser update!"),  # one byte differs
]

for name, content in downloads:
    digest = hashlib.sha256(content).hexdigest()
    verdict = KNOWN_BAD.get(digest, "no match")
    print(f"{name:<20} {digest[:16]}...  {verdict}")

holiday-photos.zip   298281f86f3327fa...  no match
Invoice_0815.docm    70460b54d114ecc9...  Demo.Dropper.A
browser-update.exe   0033177d12746e35...  no match

The exact copy is caught; the file that differs by a single byte is not, because any change gives a completely different hash. Malware authors exploit this by changing every copy slightly. That is why modern endpoint protection also looks at behavior. One classic behavior rule: a single process renaming or rewriting many files within seconds looks like ransomware at work.

from collections import defaultdict

# File events from an endpoint: (seconds since 09:00, process, action, file).
events = [
    (12, "WINWORD.EXE", "write", "report-q3.docx"),
    (40, "OneDrive.exe", "write", "report-q3.docx"),
    (300, "svchelper.exe", "rename", "budget.xlsx -> budget.xlsx.locked"),
    (301, "svchelper.exe", "rename", "contracts.pdf -> contracts.pdf.locked"),
    (301, "svchelper.exe", "rename", "photo-01.jpg -> photo-01.jpg.locked"),
    (302, "svchelper.exe", "rename", "photo-02.jpg -> photo-02.jpg.locked"),
    (303, "svchelper.exe", "rename", "notes.txt -> notes.txt.locked"),
    (305, "EXCEL.EXE", "write", "budget-v2.xlsx"),
]

WINDOW = 10      # seconds
THRESHOLD = 5    # file changes by one process within the window

changes = defaultdict(list)
for second, process, action, _ in events:
    changes[process].append(second)

for process in sorted(changes):
    times = changes[process]
    burst = max(sum(1 for t in times if start <= t < start + WINDOW) for start in times)
    status = "ALERT: possible ransomware behavior" if burst >= THRESHOLD else "ok"
    print(f"{process:<14} max {burst} changes in {WINDOW}s  {status}")

EXCEL.EXE      max 1 changes in 10s  ok
OneDrive.exe   max 1 changes in 10s  ok
WINWORD.EXE    max 1 changes in 10s  ok
svchelper.exe  max 5 changes in 10s  ALERT: possible ransomware behavior

Real EDR products combine hundreds of such rules with machine learning, and they have to handle legitimate bursts too: a backup program or a sync client also touches many files quickly. Tuning those exceptions without opening a blind spot is a large part of the work.

When you suspect malware

What you do in the first minutes matters. In an organization, the incident response playbook decides; these steps are the common core (see Incident Response):

1. Isolate the device: unplug the network cable and switch off Wi-Fi, or let the security team isolate it remotely with the EDR tool. This stops spreading and stops data from leaving.
2. Do not power off by reflex: memory holds evidence — running processes, network connections, sometimes encryption keys — that is lost when the device is switched off. If forensics matter, leave it running and isolated unless the playbook or the security team says otherwise.
3. Report immediately to the service desk or the security team, with what you saw and when. Take a photo of any message on the screen.
4. Do not use the device to log in to other systems, and change passwords from a different, clean device — assume that anything typed on the infected one was captured.
5. Recover from known-good sources: in most organizations an infected computer is reimaged rather than cleaned, because you can never be completely sure a cleaned system is clean.

Ransomware in depth

Ransomware deserves its own section because it is the attack most likely to stop an entire organization — hospitals, municipalities, manufacturers and logistics companies have all been brought to a halt by it. In organizations that run critical infrastructure, ransomware on office systems can force a shutdown of operational systems too, simply because nobody can be sure they are unaffected.

Prevention

• Close the usual doors: multi-factor authentication on VPN, remote access and email; no RDP directly reachable from the internet; fast patching of internet-facing systems.
• Limit how far an intruder can move: least privilege, separate administrator accounts, segmentation, and protection of the domain controllers and the backup servers in particular.
• Make sure at least one backup copy is offline or immutable, protected by separate credentials, and that restores are tested — including how long a complete restore takes.
• Watch for the preparation: new administrator accounts, remote management tools that appear out of nowhere, large data transfers out, deleted shadow copies and backups.
• Prepare the response before you need it: a ransomware playbook, contact details on paper, and an exercise to test them.

The decision not to pay

Law enforcement agencies — including the Dutch police and Europol — and national cybersecurity centers advise against paying. Payment funds the next attack, marks you as a willing payer, and buys no guarantee: decryptors can be slow or broken, and stolen data may still be sold or published. In some cases paying can even be illegal, for example when the group is under sanctions. Whether an organization pays is a decision for its board, with legal advice and in contact with the police — never for the service desk or an individual administrator. The best way to make sure the question never comes up is backups you can restore from and a tested plan.

Before anyone considers payment, it is worth checking No More Ransom (nomoreransom.org), a project started in 2016 by the Dutch police, Europol and IT security companies. It offers free decryption tools for ransomware families whose encryption has been broken or whose keys were seized. In the Netherlands, also report the incident to the police, and an organization that falls under the NIS2 directive (the European Union's second Network and Information Security directive) has notification duties to its supervisory authority or computer security incident response team (CSIRT); the National Cyber Security Centre (NCSC-NL) supports organizations in critical sectors. If personal data was taken, the breach may also have to be reported to the Autoriteit Persoonsgegevens within 72 hours (see Privacy and Data Protection).