Malicious software, in four families: viruses, worms, trojans and ransomware

Malicious software is one of the threats that turns vulnerabilities into real losses. In a risk program you do not need to be a reverse engineer, but you do need to know how the main families spread and what they do, because that tells you which controls reduce their likelihood and impact. NIST’s glossary defines each family by how it spreads, and that is the most useful way to remember them.

Viruses: they need a host and a human

A virus attaches itself to another program or file and spreads when that host is run or shared, for example a document with a malicious macro opened by a user. NIST describes it as a program that replicates by infecting other programs, usually needing a person to take an action. Controls: limit who can run macros and unsigned code, keep security features like Gatekeeper on, and train people to be wary of unexpected attachments.

Worms: they spread on their own

A worm is self-replicating: it copies itself across networks without anyone clicking, usually by exploiting a vulnerability in a network service. Worms can spread worldwide in hours, which is why unpatched internet-facing systems are so dangerous. MITRE ATT&CK tracks this behaviour under “Exploitation of Remote Services” (T1210). Controls: patch management (previous lesson), network segmentation, and not exposing services to the internet that do not need to be.

Trojans: they arrive by invitation

A trojan pretends to be something useful, such as a cracked app, a fake update or a free tool, so that the victim installs it willingly. Once running, it may steal passwords and browser data, open a backdoor or download more tools. On the Mac, “infostealer” trojans are among the most common threats. Controls: install software only from trusted sources, keep Gatekeeper and notarization checks on, and watch which apps try to send data out.

Ransomware: it holds data hostage

Ransomware encrypts files and demands payment, and increasingly steals data first to threaten publication, a tactic CISA calls double extortion. It often arrives through phishing, stolen remote-access passwords or unpatched vulnerabilities, which means it sits at the end of a chain that the other controls in this course can break. Controls: offline backups, MFA on remote access, prompt patching, and watching for large or unusual uploads.

Real attacks mix the families

These labels describe behaviours, and modern attacks combine them. A trojan disguised as a cracked app may install a backdoor, which later downloads ransomware; some ransomware adds worm-like spreading to reach every machine on a network. That is why the risk view in this course matters more than the name on the sample: each step in the chain, delivery, execution, spreading, contacting its operators and sending data out, is a place where a control can stop it. Mapping incidents to MITRE ATT&CK techniques such as User Execution (T1204) and Exploitation of Remote Services (T1210) helps you see which step your defences cover and where the gaps are.

Where a firewall fits, and where it doesn’t

Antivirus and endpoint security tools look at files and processes; a network firewall looks at connections. FireAI is the second kind: it does not scan files, but it controls which apps may connect and where, shows unexpected destinations on the world map, and can block addresses on threat lists. That matters because most malicious software needs the network, to download its next stage, report to its operators or send stolen data out. Layering both kinds of tools is the point.

For a deeper look at each family, rootkits, the people behind them and where stolen data ends up, take the “Malware and the hidden internet” course on FireAI University.