🦠 Malware: Types & Detection
Seven types of malicious software and how to detect each⏱ ~2 min
A carpenter doesn't use the same tool for every task. An attacker wanting to steal passwords uses different malware than one wanting to extort money. Understanding malware types means understanding attacker goals — which tells you what defenses matter. 'Malware' just means 'malicious software.' The type tells you everything else.
Seven Malware Types — Know Each One
| Type | Spreads How | What It Does | Goal | Defense |
|---|---|---|---|---|
| Virus | Hides in legitimate files; spreads when you open/execute the infected file | Damages files, steals data, delivers payloads when triggered | Damage, theft, persistence | Don't open unknown attachments; antivirus; keep OS updated |
| Worm | Self-spreads across networks automatically — no user action needed | Consumes bandwidth/CPU; drops additional malware; recruits into botnets | Spread, DDoS platform | Patch systems; firewalls; network segmentation |
| Trojan | Disguised as legitimate software (game mod, free app, fake update) | Once installed: steals passwords, installs ransomware, creates backdoor | Access, theft, control | Only download from official sources; verify checksums; antivirus |
| Ransomware | Phishing, trojan, unpatched vulnerabilities, RDP brute force | Encrypts files; displays ransom note demanding crypto payment | Financial extortion | Offline backups; MFA; patch management; email filtering |
| Spyware/Keylogger | Bundled with free apps, malicious browser extensions, trojans | Records keystrokes, screenshots, clipboard; monitors browsing | Credential theft, surveillance | Download only from official stores; review extensions; antivirus |
| Adware | Free software bundles, fake plugin updates, shady websites | Displays unwanted ads, redirects searches, tracks browsing | Ad revenue, tracking, doorway to worse malware | Trusted sources only; ad blockers; custom installs |
| Bot / Botnet | Phishing, worms, weak passwords on IoT/routers | Attacker remotely controls your device for DDoS, spam, cryptomining | Platform for attacks | Change default passwords; update all devices including IoT; MFA |
Malware Detection Methods
- •Signature-based detection — matches malware code against a database of known patterns. Fast and precise, but misses brand-new malware ('zero-day')
- •Behavioral detection — monitors what programs do, not what they look like. If a process suddenly encrypts thousands of files, flag it regardless of signature
- •Heuristic analysis — examines code structure for suspicious patterns even without a signature match
- •Sandboxing — runs suspicious files in an isolated virtual environment, observing behavior without risking real systems
- •SIEM correlation — connects anomalies across multiple systems; C2 traffic + privilege escalation + file encryption = active ransomware
Why Updates Are Your Best Defense
Most malware doesn't exploit unknown vulnerabilities — it exploits known ones that already have patches available. WannaCry ransomware (2017) exploited EternalBlue, a Windows vulnerability Microsoft patched 2 months earlier. Organizations that hadn't applied the patch were wiped out. The NHS, FedEx, and over 200,000 other organizations had the patch available and didn't install it.
A hospital's IT team notices that one workstation is generating unusually high network traffic at 3 AM, connecting to an IP address in Eastern Europe on port 443. The workstation's antivirus shows no alerts. The user reports that files on their shared drive are 'corrupted' and no longer openable. Their desktop shows a message: 'Your files are encrypted. Pay 5 BTC to recover them.' What type of malware is this, and why didn't antivirus catch it?