Malware—malicious software—is the primary technical mechanism through which security threats materialize in computing systems. Understanding malware taxonomy is essential for security professionals because different malware types require different detection strategies, response procedures, and preventive controls.

The malware landscape has evolved from simple curiosity-driven viruses to sophisticated, profit-driven criminal enterprises. Modern malware often combines multiple techniques, blurring traditional category boundaries. Nevertheless, understanding the fundamental types provides the conceptual foundation for analyzing any malicious software encounter.

Before examining specific types, we need to understand the dimensions along which malware is classified. Any piece of malware can be characterized by multiple attributes:

Primary classification dimensions:

The Blended Threat Reality:

Modern malware typically combines characteristics from multiple categories. Ransomware, for example, might initially spread like a worm (self-propagating), install itself like a trojan (masquerading as legitimate software), employ rootkit techniques for stealth, and deliver a destructive encryption payload.

The traditional categories we'll examine should be understood as building blocks—describing capabilities that are often combined in real-world threats. Understanding each building block helps you analyze complex, blended threats.

A computer virus is malicious code that attaches itself to a legitimate host program and requires that host to execute in order to run. Like biological viruses that need host cells to reproduce, computer viruses cannot run independently—they parasitize legitimate software.

Defining characteristics of viruses:

• Requires a host — Must attach to executable code (programs, scripts, documents with macros, boot sectors)
• Requires user action — Someone must execute the infected host for the virus to activate
• Self-replicating — Once active, it seeks new hosts within the system to infect
• Payload delivery — Besides replication, viruses typically carry additional malicious functionality

Virus Lifecycle:

1. Infection — The virus attaches to a host (executable, document, boot sector)
2. Dormancy — The infected host waits for execution (may be immediate or delayed)
3. Triggering — User executes the host; virus code activates
4. Replication — Virus seeks new hosts on the system and infects them
5. Payload execution — Virus performs its malicious purpose (data destruction, information theft, etc.)

The Importance of User Action:

Viruses are fundamentally limited by their dependency on user execution. A virus in an email attachment does nothing until someone opens it. This makes user education a powerful defense—trained users who don't execute suspicious files significantly reduce virus risk.

A worm is self-replicating malware that spreads across networks without requiring a host program or user interaction. Unlike viruses that wait for users to execute infected files, worms actively exploit vulnerabilities or abuse network services to propagate automatically.

Key distinctions from viruses:

Worm Propagation Mechanisms:

Worms exploit various channels to spread:

• Network vulnerabilities — Exploiting unpatched services (SQL Slammer exploited SQL Server, WannaCry exploited SMB)
• Email — Self-mailing worms use address books to spread (Mydoom, Storm)
• Removable media — USB worms spread when media is connected (Conficker, Stuxnet)
• Instant messaging — Spreading through chat platforms with malicious links
• File sharing — Placing copies in shared directories and P2P networks

The Exponential Danger:

Worms can spread exponentially because each infected system becomes an active infection vector. The Code Red worm infected 359,000 computers in under 14 hours. The Slammer worm infected 75,000 systems in 10 minutes, doubling infected hosts every 8.5 seconds at its peak. This speed makes worms devastating—they can saturate networks faster than humans can respond.

A Trojan horse (or simply 'Trojan') is malware that disguises itself as legitimate software to trick users into installing it. Named after the Greek mythology of the wooden horse used to infiltrate Troy, trojans rely on deception rather than exploitation or self-replication.

Defining characteristics:

• Deception-based — Appears to be legitimate, useful, or desirable software
• No self-replication — Unlike viruses and worms, trojans don't copy themselves
• User-installed — The victim voluntarily installs the malware (under false pretenses)
• Payload-focused — The primary purpose is delivering malicious functionality

Distribution Vectors:

Trojans reach victims through various deceptive channels:

• Fake software — Pirated applications, cracked games, 'free' premium tools
• Malicious attachments — Email attachments disguised as invoices, shipping notices, job applications
• Compromised downloads — Legitimate software sites hacked to serve trojanized versions
• Malvertising — Malicious advertisements on legitimate websites
• Social media — Fake profiles sharing malicious links and downloads
• Tech support scams — Convincing victims to install 'support software'

The Social Engineering Core:

Trojans fundamentally exploit human psychology rather than technical vulnerabilities. The attack succeeds when users believe the malware is legitimate. This makes user awareness crucial—technical controls can filter known malicious software, but a convincing enough disguise can bypass technical defenses entirely.

Ransomware is malware that denies victims access to their data or systems until a ransom is paid. It represents the industrialization of cybercrime—a business model where technical capability directly converts to revenue. Ransomware has evolved from nuisance attacks into existential threats to organizations.

Ransomware operational models:

The Ransomware Economy:

Ransomware has evolved into a sophisticated criminal ecosystem:

• Ransomware-as-a-Service (RaaS) — Developers create ransomware and license it to affiliates who conduct attacks, splitting proceeds (typically 70-80% to affiliates)
• Initial Access Brokers (IABs) — Specialists who compromise organizations and sell access to ransomware operators
• Negotiation services — Professional negotiators who handle victim communication
• Cryptocurrency laundering — Services that clean ransom payments through mixing and chain-hopping

Modern Attack Pattern:

1. Initial Access — Phishing, exploited VPN, or purchased from IAB
2. Reconnaissance — Map network, identify valuable data, locate backups
3. Lateral Movement — Spread through network using stolen credentials
4. Data Exfiltration — Copy sensitive data for double extortion leverage
5. Backup Destruction — Delete or encrypt backups to prevent recovery
6. Ransomware Deployment — Encrypt systems across the organization simultaneously
7. Extortion — Demand payment; threaten data publication if refused

A rootkit is malware designed to hide its presence (and the presence of other malware) from detection while maintaining persistent privileged access. The term originated from Unix 'root' (administrator) and 'kit' (software tools). Rootkits don't necessarily perform malicious actions themselves—they enable other malware to operate undetected.

Rootkit operating levels:

Rootkit Techniques:

Hooking: Rootkits intercept system calls and API functions, filtering results before returning to calling programs:

• A directory listing call returns all files except the rootkit's files
• A process listing filters out the rootkit's processes
• Network connection queries hide the rootkit's C2 connections

Direct Kernel Object Manipulation (DKOM): Kernel-mode rootkits modify kernel data structures directly:

• Unlinking process entries from process lists (process becomes invisible)
• Modifying kernel tables that map memory to files
• Altering permission structures to grant hidden privileges

Persistence Mechanisms:

• Registry modifications for user-mode persistence
• Driver loading for kernel-mode persistence
• MBR/VBR modification for boot-level persistence
• UEFI variable manipulation for firmware persistence

Spyware is malware designed to collect information about a user or organization without consent. While all malware that exfiltrates data could be considered spyware, the term typically refers to software whose primary purpose is surveillance rather than immediate financial gain.

Spyware categories:

Nation-State Spyware:

Government-grade spyware represents the most sophisticated surveillance capability:

Pegasus (NSO Group):

• Zero-click exploitation of iOS and Android devices
• Full device access: messages, calls, location, camera, microphone
• Used by governments worldwide against journalists, activists, and opposition figures
• Can exploit devices without any victim interaction

Predator (Cytrox/Intellexa):

• Similar capabilities to Pegasus
• One-click and zero-click exploitation
• Deployed against journalists and civil society

FinFisher/FinSpy:

• Sold to law enforcement and intelligence agencies
• Desktop and mobile capabilities
• Keylogging, screen capture, communication interception

Data Collection Capabilities:

Modern spyware can capture:

• Encrypted message content (WhatsApp, Signal, Telegram—captured on device before/after encryption)
• Live microphone and camera access
• Real-time location tracking
• Keystroke logging
• Screenshot capture
• Contact lists and call logs
• Stored passwords and credentials
• Application data from any installed app

A bot is malware that converts an infected system into a remotely controlled agent. When many bots are controlled by a single entity, they form a botnet—a distributed network of compromised systems that can be commanded collectively. Botnets represent force multiplication for attackers, enabling operations that would be impossible from a single system.

Botnet capabilities:

Botnet Architecture:

Centralized (Client-Server):

• Bots connect to command-and-control (C2) servers to receive instructions
• Simple to operate but vulnerable—taking down C2 servers kills the botnet
• May use multiple C2 servers with fallback mechanisms

Decentralized (Peer-to-Peer):

• Bots communicate with each other without central servers
• Extremely resilient—no single point of failure
• Commands propagate through the P2P network
• Used by sophisticated botnets like Gameover Zeus and Necurs

Hybrid:

• Combines centralized control with P2P resilience
• P2P used for redundancy when C2 servers are unavailable
• Most modern large botnets use hybrid approaches

Modern malware employs sophisticated techniques to evade detection, resist analysis, and maintain persistence. Understanding these techniques is essential for defenders because basic detection approaches fail against advanced threats.

Evasion and stealth techniques:

Fileless Malware Deep Dive:

Fileless malware represents a significant evolution in attack techniques:

1. Initial Execution — Often via macro-enabled documents, exploits, or malicious scripts
2. Memory-Only Operation — Malicious code exists only in RAM, never as files on disk
3. Registry Persistence — Commands stored in registry keys; executed on boot without file creation
4. Living-off-the-Land — Malicious logic executed through PowerShell, WMI, or other built-in tools

Why fileless is dangerous:

• Traditional antivirus scans files on disk—no files means no detection
• Forensic artifacts are minimal—investigation is difficult
• Legitimate tool usage blends with normal administrator activity
• Memory clears on reboot, removing evidence (unless persistence established)

Detection requires:

• Behavioral analysis of process execution patterns
• Memory scanning capabilities
• Script block logging for PowerShell and similar engines
• Anomaly detection for legitimate tool misuse

We've surveyed the major categories of malicious software, from classic viruses to modern fileless threats. This taxonomy provides the vocabulary for discussing specific threats and the conceptual foundation for understanding how malware operates.

What's Next:

With malware types understood, we'll examine Attack Vectors—the pathways through which malware and other threats reach their targets. Understanding how threats are delivered is essential for implementing effective preventive controls.