Network Security Malware Types
Malware (malicious software) is any program designed to harm, disrupt, or gain unauthorized access to a system. Every piece of malware has a delivery mechanism (how it gets in), a persistence mechanism (how it stays), and a payload (what damage it causes). Understanding each type helps defenders choose the right detection and removal strategy.
Malware Delivery Paths
Email attachment → User opens .exe, .docm, .pdf with exploit Malicious website → Drive-by download, browser exploit USB / physical → Infected drive plugged into workstation Software supply chain → Legitimate software update contains malware Network exploit → Malware spreads without any user interaction Social engineering → User is tricked into installing it manually
Virus
A virus attaches itself to a legitimate file or program. When the infected file runs, the virus code executes first, then infects other files on the same system. Like a biological virus, it needs a "host" to spread and requires a human action (opening the file) to activate.
Virus Spread Pattern: Infected file: document.exe → User opens document.exe → Virus code runs → infects report.exe, spreadsheet.exe, game.exe → User copies game.exe to USB and shares with colleague → Colleague opens game.exe → new system infected Virus needs: human action to execute, existing files to attach to.
Worm
A worm is self-replicating malware that spreads across networks without any human interaction. It exploits vulnerabilities in network services to copy itself to other machines automatically. The WannaCry ransomware worm infected 300,000 computers in 150 countries within 24 hours in 2017 by exploiting a Windows vulnerability.
Worm Spread Pattern: Infected PC (192.168.1.10) → Scans network for vulnerable machines → Finds 192.168.1.11 with unpatched SMB service → Exploits vulnerability, copies itself to 192.168.1.11 → 192.168.1.11 now infected, scans for MORE victims → Exponential spread across entire network Worm needs: a network vulnerability. No human action required.
Trojan Horse
A Trojan disguises itself as a legitimate, useful program. The victim installs it willingly. Once running, it performs its hidden malicious purpose — creating a backdoor, stealing data, or downloading additional malware. Unlike viruses, Trojans do not replicate themselves.
Trojan Example:
User downloads: "Free_PDF_Converter.exe" from unofficial site
Visible behavior: Opens a PDF converter that works normally
Hidden behavior: Creates backdoor → attacker connects remotely
Keylogger starts recording all keystrokes
Steals browser saved passwords and sends to attacker
User thinks: "I got a free PDF converter!"
Reality: Attacker now has full access to the PC.
Ransomware
Ransomware encrypts the victim's files and demands payment (usually cryptocurrency) for the decryption key. Modern ransomware operations also steal data before encrypting it and threaten to publish it if the ransom is not paid — a "double extortion" tactic that pressures even organizations with good backups.
RANSOMWARE ATTACK TIMELINE:
Day 0: Attacker gains initial access (phishing, exploit)
Day 1-14: Attacker moves quietly through network, escalates privileges,
steals sensitive data, identifies backup systems
Day 15: Ransomware executes:
→ Encrypts all files (documents, databases, backups)
→ Displays ransom note: "Pay $2M in Bitcoin in 72 hours"
→ Threatens to publish stolen data if payment delayed
Ransom note appears:
┌─────────────────────────────────────────────────┐
│ YOUR FILES HAVE BEEN ENCRYPTED │
│ To recover your data, pay 2.0 BTC to: │
│ bc1q... │
│ Countdown: 71:58:33 │
│ After deadline, price doubles. │
│ We have also downloaded 500GB of your data. │
└─────────────────────────────────────────────────┘
Spyware and Keyloggers
Spyware silently monitors user activity and sends data to the attacker. Keyloggers specifically record every keystroke — capturing passwords, banking details, and private messages. Many spyware packages combine keylogging with screenshot capture and webcam access.
Rootkit
A rootkit hides deep in the operating system, often at kernel level. It conceals the presence of other malware by intercepting operating system calls that would reveal malicious files or processes. An infected system appears clean to standard antivirus scans because the rootkit intercepts the scan and hides the malware from it.
ROOTKIT HIDING MECHANISM: Antivirus asks OS: "List all running processes." OS would normally return: explorer.exe, chrome.exe, MALWARE.exe Rootkit intercepts: explorer.exe, chrome.exe ← MALWARE.exe removed! Antivirus sees: Clean system Reality: Malware is running and hiding
Botnet Malware
Botnet malware turns the infected device into a "zombie" controlled by a remote command-and-control server. The device can then be used for DDoS attacks, sending spam, mining cryptocurrency, or serving as a pivot point for further attacks — all without the owner's knowledge.
Fileless Malware
Fileless malware runs entirely in memory without writing files to the disk. Traditional antivirus scans look for malicious files — fileless malware evades these scans because there are no files to detect. It typically uses legitimate system tools (PowerShell, WMI) to execute malicious commands.
Fileless Attack Chain: User clicks malicious link → Browser exploits PowerShell → PowerShell downloads and runs attack script (in memory only) → No file ever written to disk → Traditional AV sees: nothing unusual → Memory-based detection needed: behavioral analysis, EDR tools
Malware Defense Layers
Defense Layer | Malware It Stops ---------------------------|------------------------------------------ Email filtering | Malicious attachments, phishing links Web proxy / URL filtering | Drive-by downloads, malicious sites Antivirus (signature-based)| Known malware with recognized signatures EDR (Endpoint Detection) | Unknown malware, fileless attacks, behavior Patching | Exploits targeting unpatched vulnerabilities Application allowlisting | Blocks execution of unapproved software Network segmentation | Limits worm spread and lateral movement Backups (offline/immutable)| Ransomware recovery without paying ransom User awareness training | Stops Trojans and phishing-delivered malware
No single tool stops all malware. Modern attacks chain multiple techniques — a phishing email delivers a Trojan that installs a rootkit that downloads ransomware while also exfiltrating data. Layered defenses targeting each stage of the attack chain provide the best protection.