Know the Enemy by Its Shape

Malware (malicious software) is any program written to harm or compromise a system — and modern malware is a business, not a prank. Knowing the families helps you both sound the alarm on the right label and pick the right defense, because detection and containment differ by type.

The Core Families

  • Virus: self-replicating code that attaches to files or boot sectors and needs a host — it usually requires user action (opening a document, running an installer) to spread.
  • Worm: self-replicating and self-propagating over the network without any user action — the classic email-and-netBIOS plagues and, more recently, ransomware-worm hybrids that traverse exposed ports.
  • Trojan: a program that looks useful (a cracked installer, a "codec") and does something else — keyloggers, backdoors, credential stealers often arrive as trojans.
  • Ransomware: encrypts files or the whole disk and demands payment. It has industrialized: modern gangs steal data first, then encrypt, so "we'll just not pay" is not the clean answer they once tried.
  • Spyware/Adware: tracks activity, harvests data, or serves aggressive ads; the goal is credential theft or just monetization of your browsing.
  • Rootkit: hides its own presence — hooks filesystem/process listing calls so even a cleaned drive does not show it. Detection usually requires a trusted boot environment, not a compromised running OS.
  • RAT (Remote Access Trojan): gives the attacker interactive control over the machine — a remote shell with your privileges.
  • Fileless malware: never writes a traditional malicious file; it runs in memory using PowerShell/WMI or abuses legitimate tools (living off the land). This is why "no suspicious files found" means little in 2026.

How It Gets In

The delivery paths are a checklist, not a mystery: phishing attachments and links (the social-engineering lesson), drive-by downloads from compromised ad networks, exploit kits that target unpatched browsers and plugins, USB baiting (the lesson's baiting ploy), supply-chain (a poisoned dependency or installer — the supply-chain lesson), and RDP/SSH brute force against exposed ports. The common element is that every vector either bypasses a human judgment or exploits a missing patch — which is exactly which two defenses to buy.

Detection and Defense Stack

Layer the controls so no single failure is total: endpoint detection and response (EDR) watches process behavior (a Word doc spawning PowerShell going out to the internet is a red flag before any binary is written); antivirus/next-gen AV catches known signatures and fileless components; the firewall + egress limits what malware can exfiltrate; patching closes the exploit-kit seams; least privilege + application allowlisting means even successful code runs with a limited identity; and email filtering + security awareness blocks the delivery at the door. Backups, immutable and air-gapped, are the only thing that makes ransomware survivable without paying — tested restores, not purchased restores, are the difference.

The Response Is Not Antivirus

The eventual infection is an incident, not an AV task: isolate the host (cut its network access), preserve evidence for the incident-response lesson, contain laterally (the malware on one machine is a scout for the fleet), then rebuild and restore from your tested backups. Speed beats perfection — the cost of ransomware is dominated by how long the attacker has to spread and encrypt before containment.