Malware
Malware, short for 'malicious software,' is a general term encompassing various types of harmful software whose purpose is to damage, disrupt operation, or gain unauthorized access to computer systems, networks, or devices.
What is Malware?
Malware definition: malware is software or firmware built to run an unauthorised process that harms a system’s confidentiality, integrity or availability — this is, in short, how NIST defines it, naming viruses, worms, Trojan horses and other code that infects a host as examples, along with spyware and some forms of adware.
Malware, short for “malicious software,” is a general term encompassing various types of harmful software whose purpose is to damage, disrupt operation, or gain unauthorized access to computer systems, networks, or devices. How different these categories can be is shown by the computer worm, which spreads without user involvement, and the virus, which needs a host. A practical guide to protecting a company is available in the article What is malware and how to protect yourself.
Malware Definition
Malware is any software designed to cause harm or gain unauthorized access to a computer system. It encompasses a wide range of malicious programs, from viruses and trojans to ransomware and spyware.
Types of Malware
The main types of malware are:
-
Viruses: Infect files and spread to other computers.
-
Worms: Self-propagate through networks independently.
-
Trojans: Hide under the guise of legitimate software.
-
Ransomware: Encrypts data and demands ransom for unlocking.
-
Spyware: Secretly collects information about the user.
-
Adware: Displays unwanted advertisements.
-
Keyloggers: Record keystrokes.
Virus, worm and Trojan — how the classic categories differ
NIST SP 800-83 separates the classic categories by how they spread:
| Category | Replicates | Needs a host file or program | Typical start |
|---|---|---|---|
| Virus | yes — inserts copies of itself into programs or data files | yes | often a user action, such as opening a file |
| Worm | yes — as a self-contained program | no | usually without user involvement (a vulnerable network service or mass mailing) |
| Trojan horse | no | no — it is a separate program that looks harmless | the user runs it |
The same publication also lists malicious mobile code — software sent from a remote host and executed locally without the user’s explicit instruction — and blended attacks that combine several of these methods.
Attacker tools that malware delivers
Malware often installs further tools that give the attacker access to the computer and its data. NIST lists among them backdoors (programs listening for commands, including bots and remote administration tools), keystroke loggers, rootkits that hide their own presence, malicious browser plug-ins that can monitor all browser use, email generators that send spam and malware, and attacker toolkits (sniffers, port and vulnerability scanners, password crackers). Strictly speaking, NIST notes, these tools are not malware themselves, because they cannot infect a host on their own — malware or another attack mechanism has to install them.
How Does Malware Work?
Malware can infect systems in various ways:
- Through email attachments or links
- Via infected websites
- By exploiting security vulnerabilities
- Through infected USB devices
- Via fake software updates
After infection, malware can perform various harmful actions, such as data theft, file damage, or system takeover.
NIST stresses that malware frequently gets in through security flaws in operating systems and applications, which is why prompt patching is one of the foundations of protection. Some phishing attacks also overlap with malware: the fake message or website installs a keystroke logger or another attacker tool to gather more data.
Threats Associated with Malware
Main threats include:
- Theft of confidential personal and financial data
- Loss or damage to important files and data
- Disruption of system and network operation
- Financial losses (e.g., in case of ransomware)
- User privacy violations
Examples of Famous Malware Attacks
-
WannaCry (2017): Global ransomware attack.
-
Stuxnet (2010): Sophisticated worm attacking industrial systems.
-
Zeus (2007): Banking trojan stealing financial data.
How to Detect Malware?
Malware detection methods include:
- Using up-to-date antivirus software
- Regular system scanning
- Monitoring unusual network activity
- Analyzing suspicious files and processes
Methods of Protection Against Malware
Effective protection requires a multi-layered approach:
- Updating operating systems and software
- Using strong passwords and two-factor authentication
- Regularly creating data backups
- Caution when opening attachments and clicking on links
- Using a firewall
NIST SP 800-83 arranges malware prevention into policy, user awareness, vulnerability mitigation and threat mitigation — the last covering antivirus software, intrusion prevention systems, firewalls, content filtering and application allow-listing. An EDR/XDR tool collects signals from endpoints, but someone has to analyse them at night and at weekends too. In the Managed EDR/XDR service, the nFlo team does this: it assesses alerts, runs threat hunting and isolates compromised computers.
Best Practices for Protection Against Malware
- User education in cybersecurity
- Implementing security policies in organizations
- Regular system security audits
- Using advanced endpoint protection tools
- Network segmentation to limit malware spread
What to do after a malware infection
NIST SP 800-83 follows the incident response process from SP 800-61 (revision 2), which has four named phases: “preparation”, “detection and analysis”, “containment, eradication and recovery” and “post-incident activity”. Revision 3 of SP 800-61, published in April 2025, superseded revision 2 and reorganises incident response recommendations around the NIST Cybersecurity Framework (CSF) 2.0, as a CSF 2.0 Community Profile. In a malware incident, containment comes first and has two goals: stop the malware from spreading and prevent further damage to hosts. The organisation should decide in advance how it will choose containment methods — for example, cutting off an infected machine’s network connectivity — and only then remove the malware and restore systems.
Malware vs. Other Cyber Threats
Malware is one of many cyber threats, alongside:
-
Phishing: Attempts to extract data through impersonation.
-
DDoS Attacks: Overloading systems with large amounts of traffic.
-
Exploits: Exploiting security vulnerabilities.
-
Social Engineering Attacks: Manipulating people to gain access.
Understanding the nature of malware and applying comprehensive protection measures is key to ensuring IT system security in today’s digital world.
Explore our services
Frequently asked questions
+ What is malware in simple terms?
Malware (short for 'malicious software') is any software designed to damage, disrupt, steal from, or gain unauthorised access to computer systems, networks, or data. Malware comes in many forms — viruses, ransomware, trojans, spyware, worms, rootkits, fileless malware, and increasingly AI-assisted variants. Modern malware is no longer the realm of teenage hackers; it is industrialised, sold as a service (Malware-as-a-Service), and operated by organised criminal groups, nation-states, and hacktivists. Verizon DBIR 2025 reports malware is involved in approximately 50% of breaches, with ransomware as the dominant business-impact category.
+ What are the main types of malware?
Ten major categories: (1) **Virus** — self-replicating code attached to host files, requires user action to spread, (2) **Worm** — self-propagating across networks without user action (WannaCry, Conficker), (3) **Trojan** — disguised as legitimate software, opens backdoor or steals data once executed, (4) **Ransomware** — encrypts data and demands ransom (LockBit, Cl0p, Akira), (5) **Spyware** — covert data collection (keyloggers, screen recorders, browser hijackers), (6) **Adware** — unwanted ads, often bundled with free software, (7) **Rootkit** — hides at OS level, very hard to detect (kernel rootkits, UEFI rootkits), (8) **Bot/botnet client** — turns infected machine into part of distributed attack network (Emotet, TrickBot, IcedID), (9) **Fileless malware** — operates only in memory using legitimate tools (PowerShell, WMI), evades file-scanning AV, (10) **Wiper** — destructive, no recovery option (NotPetya, HermeticWiper).
+ How does malware infect a computer?
Six main vectors: (1) **Phishing email** — malicious attachment (Office macros, ISO/LNK files, ZIP) or link to drive-by download — still the leading vector in 2026, (2) **Drive-by downloads** — compromised websites exploiting browser vulnerabilities, (3) **Malicious advertising (malvertising)** — ads on legitimate sites redirecting to exploit kits, (4) **Software supply chain compromise** — Trojanised installers, poisoned updates (SolarWinds, 3CX, MOVEit), (5) **Removable media** — USB drives, external HDDs, especially in OT/industrial environments, (6) **Vulnerable internet-facing services** — exposed RDP, unpatched VPN gateways (Fortinet, Ivanti), web application vulnerabilities. AI-assisted social engineering has substantially raised the success rate of phishing-based delivery in 2024-2026.
+ What are famous malware examples?
Five high-impact incidents: (1) **Stuxnet (2010)** — first known nation-state cyberweapon, sabotaged Iranian uranium centrifuges, (2) **WannaCry (2017)** — ransomware worm exploiting EternalBlue, hit UK NHS, huge damages, (3) **NotPetya (2017)** — destructive wiper masquerading as ransomware, huge damages, the most expensive cyberattack in history, (4) **SolarWinds Sunburst (2020)** — supply chain attack via Trojanised updates, compromised US government and Fortune 500, (5) **MOVEit / Cl0p mass exploitation (2023)** — a very large number of organisations compromised through one vulnerability in MOVEit Transfer. Lesson: even well-resourced organisations fall to malware; layered defence + tested recovery is the only reliable strategy.
+ How is malware detected?
Five complementary detection techniques: (1) **Signature detection** — matches known malicious file hashes or code patterns (effective against widespread malware, bypassed by polymorphism and zero-days), (2) **Heuristic analysis** — looks for suspicious code structures or API calls, (3) **Behavioural analysis** — monitors what processes do at runtime (modern EDR/XDR primary technique), (4) **Sandbox detonation** — runs suspicious files in isolated environment to observe behaviour (Defender for O365, Proofpoint, Mandiant), (5) **Machine learning models** — trained on millions of samples to spot novel malware. Combination is key: no single technique catches everything. Modern endpoint protection products combine all five.
+ How to protect against malware?
Layered defence — eight controls: (1) **EDR/XDR** with behaviour-based detection (CrowdStrike, SentinelOne, Defender, Sophos), (2) **Aggressive patching** — most malware exploits known CVEs, especially in browsers, Office, and edge devices, (3) **Email security** with sandbox detonation and impersonation detection, (4) **Application allow-listing** — Windows Defender Application Control, AppLocker, (5) **Restrict macros** — block Office macros from internet by default, (6) **MFA on every account** — limits damage from credential theft, (7) **Network segmentation** — slows lateral movement and limits blast radius, (8) **User awareness** with phishing simulations. Plus: immutable backups, 24/7 SOC monitoring, and tested incident response plan.
+ What is fileless malware and why is it hard to detect?
Fileless malware is malicious activity that runs entirely in memory using legitimate system tools — typically PowerShell, WMI, .NET assemblies, or Office macros — without writing executable files to disk. Common techniques: in-memory PowerShell payloads, reflective DLL injection, process hollowing, COM hijacking. Why it evades traditional defences: (1) signature-based AV looks for malicious *files* and finds none, (2) the activity uses tools already trusted by the OS, (3) memory-resident code disappears on reboot, leaving no forensic artefacts. Detection requires: behavioural EDR/XDR (process tree analysis, command-line monitoring), PowerShell and Sysmon logging, anomaly detection, and threat hunting. Modern attacks rely heavily on fileless or LotL (Living-off-the-Land) techniques.
+ What does the word malware mean?
Malware is a blend of two English words: malicious and software. In everyday speech it is often called a "computer virus", although a virus is only one type of malware, alongside worms, Trojans, ransomware and spyware, among others.
+ What is a program that exploits security flaws in software called?
It is an exploit — code that takes advantage of a vulnerability in software or an operating system to break into a computer or take control of it. An exploit is a tool in itself: it is often used to deliver the actual malware. NIST stresses that malware frequently gets in precisely through security flaws in systems and applications, which is why prompt patching is one of the foundations of protection.