Malware (malicious software) is any code designed to harm, exploit, or gain unauthorized access. Knowing the types helps you recognize behavior and choose defenses.
| Type | Defining trait |
|---|---|
| Virus | Attaches to a file; spreads when that file runs |
| Worm | Self-propagates across networks with no user action |
| Trojan | Disguised as legitimate software |
| Ransomware | Encrypts data and demands payment |
| Spyware | Covertly gathers information |
| Keylogger | Records keystrokes |
| Rootkit | Hides deep in the OS to maintain stealthy access |
| Bootkit | Infects the boot process, below the OS |
| Adware | Forces unwanted ads (often bundled) |
| Botnet agent | Enrolls the host into an attacker-controlled network |
| Fileless malware | Lives in memory; leaves little on disk |
| Logic bomb | Triggers on a condition (date, event) |
Modern ransomware uses double extortion: encrypt the data and steal a copy, threatening to leak it if unpaid. Some add triple extortion (DDoS, contacting customers). Defenses tie back to Chapter 4: immutable backups, segmentation, EDR, MFA, and user training.
Once in, attackers want to stay. Persistence mechanisms include:
Detection relies on behavioral telemetry (EDR, Sysmon) and file integrity monitoring — rootkits specifically try to defeat signature scanners.
Prevent: patching, email filtering, app control, MFA
Detect: EDR, AV, anomaly detection, logging
Contain: isolation, segmentation
Recover: backups, rebuild from known-good
No single layer is enough — defense in depth assumes some malware will get through and ensures you can catch and contain it.