> ## Documentation Index
> Fetch the complete documentation index at: https://stem-docs.intellectualpoint.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Malware
> Identify the different types of malicious software and understand how each one threatens your systems.
## What is malware?
**Malware** - short for **malicious software** - is any software intentionally designed to harm, exploit, or compromise a computer system, network, or user. It is the weapon behind most cyberattacks.
Malware comes in many forms. Some types lock your files and demand payment. Others hide silently for months, recording every keystroke. Some spread across networks on their own. Understanding the different categories of malware and how each one operates is essential for defending against them.
The term "malware" covers a broad category of threats. A single attack may use multiple types of malware together - for example, a phishing email (delivery) may contain a trojan (disguise) that installs a keylogger (payload) and a rootkit (persistence).
***
## Malware types
### 1. Ransomware
**What it does:** Encrypts your files and demands payment (a ransom) in exchange for the decryption key. If you don't pay, you lose your data permanently - unless you have backups.
**How it spreads:** Phishing emails, exploited vulnerabilities, compromised Remote Desktop Protocol (RDP), infected software downloads, supply chain attacks.
**Donuts & Dragons scenario:** It's Monday morning. You open the store and turn on the POS system. Instead of the normal register screen, a red dragon fills the monitor:
*"Your files have been encrypted. Send 2 Bitcoin to the following address within 72 hours or your data will be permanently destroyed. Do not contact law enforcement."*
Every file on the system - transaction records, employee schedules, customer data, inventory - is locked. The registers don't work. You can't process orders. The business is at a standstill.
This is ransomware.
**Real-world examples:**
* **WannaCry (2017):** Exploited a Windows vulnerability to spread across 150+ countries in a single day. Hit hospitals, factories, and government agencies. The UK's National Health Service was forced to cancel thousands of appointments.
* **Colonial Pipeline (2021):** The DarkSide ransomware group shut down the largest fuel pipeline in the eastern United States. Colonial paid \$4.4 million in ransom.
* **Kaseya (2021):** The REvil group compromised IT management software to deploy ransomware to over 1,500 businesses simultaneously through a single supply chain attack.
**Key defenses:**
* Maintain offline backups (the attacker cannot encrypt what they cannot reach)
* Patch management (close vulnerabilities before ransomware exploits them)
* Email filtering and user training (stop the delivery)
* Network segmentation (limit how far ransomware can spread)
### 2. Trojans
**What it does:** Disguises itself as legitimate software to trick you into installing it. Once installed, it carries out its hidden malicious purpose - which could be anything from stealing data to opening a backdoor for an attacker.
**How it spreads:** Fake software downloads, malicious email attachments, compromised websites, pirated software, fake updates.
**Named after:** The Trojan Horse from Greek mythology - the Greeks hid soldiers inside a giant wooden horse and gifted it to the city of Troy. The Trojans brought it inside their walls, and the soldiers emerged at night to open the gates for the Greek army.
**Examples:**
* A "free antivirus" download that actually installs spyware
* A "game crack" from a piracy forum that contains a Remote Access Trojan (RAT)
* An email attachment labeled "invoice.pdf" that is actually an executable
Trojans rely entirely on deception. They do not self-replicate - they need you to install them. This is why downloading software only from trusted sources is a critical defense.
**Key defenses:**
* Download software only from official sources
* Verify file hashes when available
* Use endpoint protection that scans downloads
* Be skeptical of "free" versions of paid software
### 3. Worms
**What it does:** Self-replicating malware that spreads across networks **without any user interaction**. Once a worm infects one system, it automatically scans for other vulnerable systems and infects them too.
**How it spreads:** Network vulnerabilities, email, file shares, removable media. The key distinction: worms spread on their own - they don't need a host file or user action.
**The difference between a worm and a virus:**
| | Worm | Virus |
| -------------------- | --------------------- | -------------------------- |
| Needs a host file | No | Yes |
| Requires user action | No | Yes (opening a file) |
| Self-replicates | Yes, across networks | Yes, but only within files |
| Spread speed | Very fast (automated) | Slower (human-dependent) |
**Real-world examples:**
* **WannaCry (2017):** Technically a ransomworm - combined ransomware with worm capabilities. Used the EternalBlue exploit to spread across networks automatically, infecting 230,000 computers in 150 countries within a day.
* **Conficker (2008):** Infected millions of computers worldwide, including military networks. Created a botnet that was never fully utilized, making researchers wonder what the authors were planning.
* **ILOVEYOU (2000):** Spread via email as a "love letter" attachment. Overwritten files and emailed itself to every contact in the victim's address book. Caused an estimated \$10 billion in damages.
**Key defenses:**
* Patch management (worms exploit known vulnerabilities)
* Network segmentation (limit how far a worm can spread)
* Intrusion detection systems (detect scanning behavior)
* Disable unnecessary network services
### 4. Viruses
**What it does:** Malicious code that attaches itself to legitimate files or programs. When you open the infected file, the virus executes and may spread to other files on the same system.
**How it spreads:** Opening infected files, running infected programs, sharing infected documents. A virus **requires user action** - it cannot spread on its own.
**Types of viruses:**
Attaches to executable files (.exe, .com). When you run the infected program, the virus code runs first, then the legitimate program. You might not notice anything wrong.
Infects the master boot record of a hard drive or removable media. Loads before the operating system starts, making it difficult to detect. Spread through infected USB drives or disks.
Hides in documents that support macros (Word, Excel, PowerPoint). When you open the document and enable macros, the virus runs. Common in phishing email attachments.
**Key defenses:**
* Antivirus software with real-time scanning
* Don't enable macros in documents from unknown sources
* Scan email attachments before opening
* Keep software updated
### 5. Spyware
**What it does:** Secretly monitors your activity and sends information to the attacker. It can collect passwords, browsing history, keystrokes, screenshots, emails, and financial information.
**How it spreads:** Bundled with free software ("bundleware"), malicious browser extensions, drive-by downloads, phishing emails, infected apps.
**What it collects:**
* Login credentials
* Credit card numbers
* Browsing habits and search history
* Email content
* Screenshots at regular intervals
* Microphone and camera feeds (in advanced versions)
**Real-world example:** In 2021, the Pegasus spyware (developed by NSO Group) was found on the phones of journalists, activists, and political leaders worldwide. It could silently access messages, emails, camera, microphone, and location data - all without the user's knowledge.
**Key defenses:**
* Be cautious with free software (read what you're agreeing to install)
* Use browser extensions sparingly and only from trusted sources
* Run anti-malware scans regularly
* Review installed programs and remove anything unfamiliar
### 6. Keyloggers
**What it does:** Records every keystroke you type - passwords, messages, credit card numbers, emails, search queries - everything. The captured data is sent to the attacker.
**How it spreads:** Installed via trojan, bundled with other malware, or deployed as a physical hardware device.
A program that runs in the background and captures every keystroke. May also take periodic screenshots. Often installed as part of a trojan or spyware package.
A physical device plugged between your keyboard and computer (or embedded in a USB cable). Stores keystrokes in internal memory. Cannot be detected by antivirus software because it is not software - it is a device.
Hardware keyloggers can be tiny - small enough to hide inside a USB connector. If you're using a shared or public computer, visually inspect the keyboard connection before typing any passwords.
**Key defenses:**
* Use multi-factor authentication (a stolen password alone isn't enough)
* Use a password manager with auto-fill (keyloggers can't capture what you don't type)
* Inspect hardware connections on shared computers
* Endpoint protection that detects keylogging behavior
### 7. Logic bombs
**What it does:** Malicious code that remains dormant until a specific condition is met - a date, a user action, the deletion of a file, or the removal of an employee from the payroll system. When the trigger condition occurs, the code executes its payload.
**How it spreads:** Doesn't spread - it is planted deliberately, usually by an insider with access to the codebase or systems.
**Example scenarios:**
* A disgruntled database administrator writes a script that drops all production tables if their username is ever removed from the employee directory
* Malicious code set to activate on a specific date, deleting all backups
* A condition that triggers data exfiltration when a competitor's domain appears in company email
Logic bombs are particularly dangerous because they can sit undetected in production systems for months or years. The person who planted it may have left the organization long before the bomb detonates.
**Real-world example:** In 2013, a system administrator at a company planted a logic bomb that would delete critical data if he was fired. When the company terminated him, the bomb activated and wiped out years of data. He was convicted and sentenced to federal prison.
**Key defenses:**
* Code review processes for all production code
* Change detection and monitoring
* Separation of duties (no single person should control critical systems alone)
* Thorough offboarding procedures (revoke access immediately)
### 8. Rootkits
**What it does:** Hides deep within the operating system - at the kernel level or even in the firmware - to give an attacker persistent, hidden access. A rootkit modifies the OS itself so that standard security tools cannot detect it.
**How it spreads:** Often installed after initial compromise (post-exploitation), bundled with other malware, or through compromised software updates.
**Why rootkits are so dangerous:**
* They can **hide files, processes, and network connections** from the operating system
* Antivirus software may not detect them because the rootkit controls what the OS reports
* They survive reboots and may even survive OS reinstallation (firmware rootkits)
* The attacker maintains access indefinitely
**Types:**
* **User-mode rootkits:** Run at the application level. Easier to detect and remove.
* **Kernel-mode rootkits:** Modify the operating system kernel. Very difficult to detect.
* **Firmware rootkits:** Embed in device firmware (BIOS/UEFI). Survive OS reinstallation.
If a kernel or firmware rootkit is detected, the safest remediation is often to **wipe and reinstall the operating system** from trusted media - or replace the hardware entirely for firmware rootkits.
**Key defenses:**
* Secure boot (prevents unauthorized code from loading during startup)
* Kernel integrity monitoring
* Trusted Platform Module (TPM) hardware
* Regular firmware updates from trusted sources
### 9. Bloatware
**What it does:** Unwanted pre-installed software that wastes system resources, degrades performance, and may contain security vulnerabilities. While not always malicious in intent, bloatware increases your attack surface.
**How it gets there:** Pre-installed by device manufacturers, bundled with software installations, added by mobile carriers.
**Examples:**
* Trial antivirus software on a new laptop
* Pre-installed games and apps on a new phone
* Third-party toolbars added during software installation
* Carrier apps on mobile devices that cannot be uninstalled
**Why it matters for security:**
* Each additional application is a potential vulnerability
* Bloatware may have excessive permissions
* Some bloatware collects and transmits user data
* It increases the attack surface without providing value
**Key defenses:**
* Perform a clean install of the OS on new devices
* Review and remove unnecessary pre-installed software
* During software installation, choose "custom" and deselect bundled extras
* Use mobile device management (MDM) to control installed applications
***
## Malware comparison table
| Malware type | How it spreads | Primary goal | Key defense |
| --------------- | ------------------------------ | -------------------------------------- | --------------------------------- |
| **Ransomware** | Phishing, RDP, exploits | Extortion (encrypt and demand payment) | Offline backups, patching |
| **Trojans** | Fake software, attachments | Various (backdoor, data theft) | Download from trusted sources |
| **Worms** | Network vulnerabilities (auto) | Propagation and payload delivery | Patching, network segmentation |
| **Viruses** | Infected files (user action) | File infection and damage | Antivirus, don't enable macros |
| **Spyware** | Bundled software, phishing | Surveillance, data collection | Careful installs, anti-malware |
| **Keyloggers** | Trojans, hardware devices | Credential and data theft | MFA, password managers |
| **Logic bombs** | Planted by insiders | Sabotage on trigger condition | Code review, access controls |
| **Rootkits** | Post-exploitation | Persistent hidden access | Secure boot, integrity monitoring |
| **Bloatware** | Pre-installed by vendors | Revenue (ads, data collection) | Clean installs, remove extras |
***
## The malware game
Think of each malware type as a character in a card game. Here are their stats.
* **Virus guide:** "Encrypts everything it touches. Demands tribute."
* **Malware signature:** File encryption + ransom note on screen
* **Special ability:** Time pressure - the ransom increases every 24 hours
* **Quarantine:** Isolate the infected system immediately. Restore from offline backups. Do not pay the ransom if you can avoid it.
* **Virus guide:** "Looks like a gift. Contains a hidden army."
* **Malware signature:** Legitimate-looking file that performs hidden actions
* **Special ability:** Social deception - convinces the user to install it willingly
* **Quarantine:** Remove the trojan and all files it created. Check for backdoors. Scan the entire system.
* **Virus guide:** "Spreads on its own. No host needed."
* **Malware signature:** Self-replication across network without user action
* **Special ability:** Speed - can infect thousands of systems in minutes
* **Quarantine:** Isolate the network segment. Patch the vulnerability it exploits. Clean every infected system.
* **Virus guide:** "Latches onto healthy files. Waits for you to open them."
* **Malware signature:** Malicious code embedded in legitimate files
* **Special ability:** Camouflage - hides inside files you trust
* **Quarantine:** Quarantine infected files. Scan with updated antivirus. Delete or clean infected files.
* **Virus guide:** "Watches everything. Reports to the enemy."
* **Malware signature:** Silent data collection and exfiltration
* **Special ability:** Stealth - operates without any visible symptoms
* **Quarantine:** Run anti-spyware scan. Change all passwords from a clean device. Check for unauthorized data transfers.
* **Virus guide:** "Records every keystroke. Your secrets are its ink."
* **Malware signature:** Keystroke capture with periodic data export
* **Special ability:** Captures credentials before encryption can protect them
* **Quarantine:** Remove the keylogger. Change all passwords from a clean device. Enable MFA on all accounts.
* **Virus guide:** "Waits patiently. Strikes when conditions are met."
* **Malware signature:** Dormant code with a trigger condition
* **Special ability:** Patience - can remain hidden for months or years
* **Quarantine:** Identify and remove the trigger code. Review all code from the same author. Restore affected data from clean backups.
* **Virus guide:** "Rewrites reality. The OS itself lies for it."
* **Malware signature:** OS-level modification to hide attacker presence
* **Special ability:** Invisibility - hides from the tools designed to find it
* **Quarantine:** Boot from trusted external media. Scan with offline rootkit detection tools. If kernel-level, wipe and reinstall the OS.
* **Virus guide:** "Not always evil. Always unwelcome. Always in the way."
* **Malware signature:** Unnecessary pre-installed software consuming resources
* **Special ability:** Persistence - difficult to fully uninstall
* **Quarantine:** Uninstall or disable. On new devices, perform a clean OS installation.
***
## Exercise: match the malware
Read each scenario and identify the malware type.
A new employee downloads what appears to be a free PDF editor from a website. After installing it, the application works normally - but in the background, it opens a network connection that allows an attacker to remotely control the computer.
**Answer:** **Trojan.** The software appeared legitimate but carried a hidden Remote Access Trojan (RAT) payload.
Every computer on the network displays a message demanding \$10,000 in Bitcoin. All files on every machine have been encrypted and have a `.locked` extension.
**Answer:** **Ransomware.** File encryption combined with a ransom demand is the signature of a ransomware attack.
An IT administrator who is about to be fired writes a database script that will delete all customer records 30 days after their account is disabled.
**Answer:** **Logic bomb.** The malicious code has a specific trigger condition (account disability) and a delayed action (30-day timer).
A single compromised laptop in the accounting department has now infected 47 other machines on the network - without anyone opening a file or clicking a link.
**Answer:** **Worm.** Self-replication across the network without user interaction is the defining characteristic of a worm.
A user notices their new laptop is running slowly. Investigation reveals 14 pre-installed applications they never asked for, including a trial antivirus, a weather widget, and three games.
**Answer:** **Bloatware.** Pre-installed, unwanted software from the device manufacturer that consumes system resources.
Security analysts discover that a server has been running a hidden process for six months. The process does not appear in task manager, and standard antivirus scans report the system as clean. Only a scan from external bootable media reveals the hidden software.
**Answer:** **Rootkit.** Hiding from the OS and standard security tools is the defining behavior of a rootkit. The need for external bootable media to detect it suggests a kernel-level rootkit.
After a breach investigation, the security team discovers that an attacker has been collecting every username and password typed into the company's customer service workstations for the past three months.
**Answer:** **Keylogger.** Capturing every keystroke - especially credentials - is the primary function of a keylogger.