Type of malware

here is the most common type of the malware:

1. What are Computer Viruses?
A virus is a type of malware that, when executed, self-replicates by modifying other computer programs and inserting their own code. When this replication succeeds, the affected areas are then said to be infected.

Virus writers use social engineering and exploit vulnerabilities to infect systems and spread the virus. The Microsoft Windows and Mac operating systems are the targets of the vast majority of viruses that often use complex anti-detection strategies to evade antivirus software.

Viruses are created to make profit (e.g. ransomware), send a message, personal amusement, demonstrate vulnerabilities exist, sabotage and denial of service, or to simply explore cybersecurity issues, artificial life and evolutionary algorithms.

Computer viruses cause billions of dollars worth of economic damage by causing system failure, wasting resources, corrupting data, increasing maintenance costs, logging keystrokes and stealing personal information (e.g. credit card numbers).

2. What is a Computer Worm?
A computer worm is a self-replicating malware program whose primary purpose is to infect other computers by duplicating itself while remaining active on infected systems.

Often, worms use computer networks to spread, relying on vulnerabilities or security failures on the target computer to access it. Worms almost always cause at least some harm to a network, even if only by consuming bandwidth. This is different to viruses which almost always corrupt or modify files on the victim's computer.

WannaCry is a famous example of a ransomware cryptoworm that spread without user action by exploiting the EternalBlue vulnerability.

While many worms are designed to only spread and not change systems they pass through, even payload-free worms can cause major disruptions. The Morris worm and Mydoom caused major disruptions by increasing network traffic despite their benign nature.

3. What is a Trojan Horse?
A trojan horse or trojan is any malware that misleads users of its true intent by pretending to be a legitimate program. The term is derived from the Ancient Greek story of the deceptive Trojan Horse that led to the fall of the city of Troy.

Trojans are generally spread with social engineering such as phishing.

For example, a user may be tricked into executing an email attachment disguised to appear genuine (e.g. an Excel spreadsheet). Once the executable file is opened, the trojan is installed.

While the payload of a trojan can be anything, most act as a backdoor giving the attacker unauthorized access to the infected computer. Trojans can give access to personal information such as internet activity, banking login credentials, passwords or personally identifiable information (PII). Ransomware attacks are also carried out using trojans.

Unlike computer viruses and worms, trojans do not generally attempt to inject malicious code into other files or propagate themselves.

4. What are Rootkits?
A rootkit is a collection of malware designed to give unauthorized access to a computer or area of its software and often masks its existence or the existence of other software.

Rootkit installation can be automated or the attacker can install it with administrator access.

Access can be obtained by a result of a direct attack on the system, such as exploiting vulnerabilities, cracking passwords or phishing.

Rootkit detection is difficult because it can subvert the antivirus program intended to find it. Detection methods include using trusted operating systems, behavioural methods, signature scanning, difference scanning and memory dump analysis.

Rootkit removal can be complicated or practically impossible, especially when rootkits reside in the kernel. Firmware rootkits may require hardware replacement or specialized equipment.

5. What is Ransomware?
Ransomware is a form of malware, designed to deny access to a computer system or data until ransom is paid. Ransomware spreads through phishing emails, malvertising, visiting infected websites or by exploiting vulnerabilities.

Ransomware attacks cause downtime, data leaks, intellectual property theft and data breaches.

Ransom payment amounts range from a few hundred to hundreds of thousands of dollars. Payable in cryptocurrencies like Bitcoin.

6. What is Keylogger?
Keyloggers, keystroke loggers or system monitoring are a type of malware used to monitor and record each keystroke typed on a specific computer's keyboard. Keyloggers are also available for smartphones.

Keyloggers store gathered information and send it to the attacker who can then extract sensitive information like login credentials and credit card details.

7. What is Grayware?
The term grayware was coined in September 2004 and describes unwanted applications or files that aren't malware but worsen the performance of the computer and can cause cybersecurity risk.

At a minimum, grayware behaves in an annoying or undesirable manner and at worst, monitors the system and phones home with information.

Grayware alludes to adware and spyware. The good news is most antivirus software can detect potentially unwanted programs and offer to delete them.

Adware and spyware are generally easy to remove because they are not as nefarious as other types of malware.

The bigger concern is the mechanism the grayware used to gain access to the computer, be it social engineering, unpatched software or other vulnerabilities. Other forms of malware such as a ransomware can use the same method to gain access.

Use the presence of adware to serve as a warning that the device or user has a weakness that should be corrected.

8. What is Fileless Malware?
Fileless malware is a type of malware that uses legitimate programs to infect a computer. Unlike other malware infections, it does not rely on files and leaves no footprint, making it challenging for anti-malware software to detect and remove. It exists exclusively as a computer memory-based artifact i.e. in RAM.

Fileless malware emerged in 2017 as a mainstream cyber threat but has been around for awhile. Frodo, Number of the Beast and the Dark Avenger were all early fileless malware attacks. More recently, the Democratic National Committee and the Equifax breach fell victim to fileless malware attacks.

Fileless malware does not write any part of its activity to the computer's hard drive making it resistant to existing anti-computer forensic strategies to incorporate file-based whitelisting, signature detection, hardware verification, pattern-analysis or time-stamping.

It leaves very little evidence that can be used by digital forensics investigators to identify illegitimate activity. That said, as it is designed to work in-memory, it generally only exists until the system is rebooted.

9. What is Adware?
Adware is a type of grayware designed to put advertisements on your screen, often in a web browser or popup.

Typically it distinguishes itself as legitimate or piggybacks on another program to trick you into installing it on your computer, tablet or smartphone.

Adware is one of the most profitable, least harmful forms of malware and is becoming increasingly popular on mobile devices. Adware generates revenue by automatically displaying advertisement to the user of the software.

10. What is Malvertising?
Malvertising, a portmanteau of malicious advertising, is the use of advertising to spread malware. It typically involves injecting malicious or malware-laden advertisements into legitimate advertising networks and webpages.

Advertising is a great way to spread malware because significant effort is put into ads to make them attract to users to sell or advertise a product.

Malvertising also benefits from the reputation of the sites it is placed on, such as high-profile and reputable news websites.

11. What is Spyware?
Spyware is malware that gathers information about a person or organization, sometimes without their knowledge, and sends the information to the attacker without the victim's consent.

Spyware usually aims to track and sell your internet usage data, capture your credit card or bank account information or steal personally identifiable information (PII).

Some types of spyware can install additional software and change the settings on your device. Spyware is usually simple to remove because it is not as nefarious as other types of malware.

12. What are Bots and Botnets?
A bot is a computer that is infected with malware that allows it to be remotely controlled by an attacker.

The bot (or zombie computer) can then be used to launch more cyber attacks or become part of a botnet (a collection of bots).

Botnets are a popular method for distributed denial of service (DDoS) attacks, spreading ransomware, keylogging and spreading other types of malware.

13. What is a Backdoor?
A backdoor is a covert method of bypassing normal authentication or encryption in a computer, product, embedded device (e.g. router) or other part of a computer.

Backdoors are commonly used to secure remote access to a computer or gain access to encrypted files.

From there, it can be used to gain access to, corrupt, delete or transfer sensitive data.

Backdoors can take the form a hidden part of a program (a trojan horse), a separate program or code in firmware and operating systems.

Further, backdoors can be created or widely known. Many backdoors have legitimate use cases such as the manufacturer needing a way to reset user passwords.

14. What is a Browser Hijacker?
A browser hijacker or hijackware changes the behavior of a web browser by sending the user to a new page, changing their home page, installing unwanted toolbars, displaying unwanted ads or directing users to a different website.

15. What is Crimeware?
Crimeware is a class of malware designed to automate cybercrime.

It is designed to perpetrate identity theft through social engineering or stealth to access the victim's financial and retail accounts to steal funds or make unauthorized transactions. Alternatively, it may steal confidential or sensitive information as part of corporate espionage.

16. What are Malicious Mobile Apps?
Not all apps available through the App Store and Google Play are legitimate. That said, the App Store is generally safer due to better prescreening of third-party apps.

Malicious apps can steal user information, attempt to extort users, gain access to corporate networks, force users to view unwanted ads or install a backdoor on the device.

17. What is a RAM Scraper?
A RAM scraper is a type of malware that harvests the data temporarily stored in-memory or RAM. This type of malware often targets point-of-sale (POS) systems like cash registers because they can store unencrypted credit card numbers for a brief period of time before encrypting them then passing them to the back-end.

18. What is Rogue Security Software?
Rogue security software tricks user into thinking their system has a security problem such as a virus and entices them to pay to have it removed. In reality, the fake security software is the malware that needs to be removed.

19. What is Cryptojacking?
Cryptojacking is a type of malware that uses a victim's computing power to mine cryptocurrency.

20. What is Hybrid Malware?
Today most malware is a combination of existing malware attacks, often trojan horses, worms, viruses and ransomware.

For example, a malware program may appear to be a trojan but once executed it may act as a worm and try to attack over victims on the network.

21. What is Social Engineering and Phishing?
While social engineering and phishing aren't malware per say. They are popular delivery mechanisms for malware attacks. For example, a phisher may be trying to get a user to log into a phishing website but may also attach an infected attachment to the email to increase their chances of success.

22. What are Bugs?
Like social engineering and phishing, bugs aren't malware but they can open up vulnerabilities for malware to exploit. A great example is the Eternal Blue vulnerability that was in Windows operating systems that led to the spread of the WannaCry ransomware crypto worm.

June 18, 2024 | By Scarface