Malware

Malware (malicious software) is a general term for software and code designed to perform unwanted or harmful actions on computer systems, networks, and user devices. Malware can be used to steal data, gain unauthorized access, disrupt systems, conduct espionage, extort victims, or secretly use computing resources.

The term is derived from malicious software. It covers many types of malicious software, from traditional computer viruses and worms to ransomware, spyware, and Trojans.

Therefore, malware and viruses are not synonymous: a virus is only one type of malware.

How Does Malware Work?

The behavior of malware depends on its purpose. Once it enters a system, malware may attempt to establish persistence, gain additional privileges, communicate with external infrastructure, or perform actions specified by the attacker.

Typical malicious activities can include:

• stealing credentials and confidential information;
• modifying, deleting, or encrypting files;
• monitoring user activity;
• installing additional malware;
• providing remote access to the system;
• using the compromised device to carry out other attacks.

For example, a malicious program can first extract saved credentials from a browser and then use them to sign in to other company services.

Some types of malware are designed to remain undetected for long periods. Others, such as ransomware, deliberately notify the user of the infection after performing certain actions.

Malware can also consist of several components. One component may be responsible for initial access, another for establishing persistence, while an additional malicious payload is downloaded later.

Main Types of Malware

Malware is primarily classified according to its behavior, propagation method, or purpose. However, a single malicious program can have characteristics of several categories at once.

Common types include:

• Virus — inserts itself into other files or programs and spreads when they are executed;
• Worm — can spread automatically between systems, including over networks;
• Trojan — disguises itself as legitimate software or is embedded within it to trick the user into executing malicious code;
• Ransomware — blocks access to data or encrypts it and then demands a ransom;
• Spyware — secretly collects information about a user or system;
• Rootkit — designed to conceal its presence and maintain privileged access to a system;
• Bot malware — connects an infected device to a botnet so that it can be remotely controlled and used to execute commands.

For example, a Trojan can pose as the installer of a well-known application and quietly download spyware once it is launched.

The boundaries between these categories can overlap. For example, ransomware may spread as a worm, while a Trojan may install spyware or other malware after execution.

How Does Malware Get Into a System?

Malware infections do not always require the exploitation of sophisticated technical vulnerabilities. Initial access is often made possible by user actions, weak account security, or missing security updates.

Malware can spread through phishing emails and malicious attachments, compromised websites, illegitimate or modified software, vulnerabilities in applications and operating systems, removable media, and other channels.

Supply chain attacks present another risk. In this type of attack, a malicious component reaches the victim through a compromised software vendor, update, or another trusted part of the supply chain.

After gaining initial access, an attacker may use malware to move further through a corporate network and compromise additional systems.

How Is Malware Detected?

Modern security tools are not limited to detecting known viruses through signatures. Because malware constantly evolves, multiple detection methods are used.

Antivirus and endpoint protection solutions can analyze file signatures, object reputation, and process behavior. EDR (Endpoint Detection and Response) solutions additionally collect information about endpoint activity and help identify suspicious sequences of events.

Sandboxing is also used to analyze potentially malicious files by executing them in an isolated environment and observing their behavior. In enterprise infrastructure, these methods are supplemented by monitoring network traffic, email, DNS, event logs, and other data sources.

Protection Against Malware

No single security measure can prevent every malware attack. Effective protection relies on a combination of technical and organizational controls.

Key measures include:

• keeping operating systems and applications up to date;
• using endpoint protection and EDR solutions;
• implementing MFA and limiting privileges;
• filtering email and web traffic;
• segmenting networks;
• backing up critical data;
• controlling the execution of applications and files;
• training users to recognize phishing and other social engineering techniques.

For example, network segmentation limits the damage when an infected workstation can no longer reach servers belonging to other departments directly.

Backups are particularly important in ransomware incidents, but backup systems themselves must also be protected against modification and deletion. Having a backup does not prevent malware infection, but it can significantly improve an organization’s ability to restore data and services.

FAQ

🠔 Back to glossary