What are 3 types of malware attacks?

Malware discussion typically encompasses three main aspects:

Índice Show

Types of malware attack vectors
Best practices against malware attacks

Objective: What the malware is designed to achieve
Delivery: How the malware is delivered to the target
Concealment: How the malware avoids detection (this item is beyond the scope of this discussion)

Here’s a breakdown of some of the objectives and delivery mechanisms observed in malware.

Objectives

Malware is created with an objective in mind. While it could be said that the objective is “limited only to the imagination of its creator,” this will focus on some of the most common objectives observed in malware.

Exfiltrate Information

Stealing data, credentials, payment information, etc. is a recurring theme in the realm of cybercrime. Malware focused on this type of theft can be extremely costly to a person, company, or government target that falls victim.

Disrupt Operations

Actively working to “cause problems” for a target’s operation is another objective seen in malware. From a virus on a single computer corrupting critical OS files (making that one system unusable) to an orchestrated, physical self-destruction of many systems in an installation, the level of “disruption” can vary. And there’s also the scenario where infected systems are directed to carry out large-scale distributed denial of service (DDOS) attacks.

Demand Payment

Some malware is focused on directly extorting money from the target. Scareware uses empty threats (ones which are unsubstantiated and/or couldn’t actually be carried out) to “scare” the target into paying some money. Ransomware is a type of malware that attempts to prevent a target from accessing their data (usually by encrypting files on the target) until the target “pays up.” While there is debate over whether victims of ransomware should or should not pay, it has become enough of a threat that some companies have preemptively purchased Bitcoin just in case they get hit with ransomware and decide to pay the ransom.

Types of malware attack vectors

There are three main types of malware attack vectors:

Trojan Horse: This is a program which appears to be one thing (e.g. a game, a useful application, etc.) but is really a delivery mechanism for malware. A trojan horse relies on the user to download it (usually from the internet or via email attachment) and run it on the target.
Virus: A virus is a type of self-propagating malware which infects other programs/files (or even parts of the operating system and/or hard drive) of a target via code injection. This behavior of malware propagation through injecting itself into existing software/data is a differentiator between a virus and a trojan horse (which has purposely built malware into one specific application and does not make attempts to infect others).
Worm: Malware designed to propagate itself into other systems is a worm. While virus and trojan horse malware are localized to one infected target system, a worm actively works to infect other targets (sometimes without any interaction on the user’s behalf).

Over the years, malware has been observed to use a variety of different delivery mechanisms, or attack vectors. While a few are admittedly academic, many attack vectors are effective at compromising their targets. These attack vectors generally occur over electronic communications such as email, text, vulnerable network service, or compromised website, malware delivery can also be achieved via physical media (e.g. USB thumb drive, CD/DVD, etc.).

Best practices against malware attacks

The following best practices can help prevent a malware attack from succeeding and/or mitigate the damage done by a malware attack.

Continuous User Education

Training users on best practices for avoiding malware (i.e. don’t download and run unknown software, don’t blindly insert “found media” into your computer), as well as how to identify potential malware (i.e. phishing emails, unexpected applications/processes running on a system) can go a long way in protecting an organization. Periodic, unannounced exercises, such as intentional phishing campaigns, can help keep users aware and observant. Learn more about security awareness training.

Use Reputable A/V Software

When installed, a suitable A/V solution will detect (and remove) any existing malware on a system, as well as monitor for and mitigate potential malware installation or activity while the system is running. It’ll be important to keep it up-to-date with the vendor’s latest definitions/signatures.

Ensure Your Network is Secure

Controlling access to systems on your organization’s network is a great idea for many reasons. Use of proven technology and methodologies—such as using a firewall, IPS, IDS, and remote access only through VPN—will help minimize the attack “surface” your organization exposes. Physical system isolation is usually considered an extreme measure for most organizations, and is still vulnerable to some attack vectors.

Perform Regular Website Security Audits

Scanning your organization’s websites regularly for vulnerabilities (i.e. software with known bugs, server/service/application misconfiguration) and to detect if known malware has been installed can keep your organization secure, protect your users, and protect customers and visitors for public-facing sites.

Create Regular, Verified Backups

Having a regular (i.e. current and automated) offline backup can be the difference between smoothly recovering from a destructive virus or ransomware attack and stressful, frantic scrambling with costly downtime/data-loss. The key here is to actually have regular backups that are verified to be happening on the expected regular basis and are usable for restore operations. Old, outdated backups are less valuable than recent ones, and backups that don’t restore properly are of no value.

In summary

Malware takes on many different forms and attacks in different ways. But with some thoughtful preparation and process improvements, as well as ongoing user education, your organization can gain-and-maintain a solid security stance against malware attacks.

A computer virus infects devices and replicates itself across systems. Viruses require human intervention to propagate. Once users download the malicious code onto their devices -- often delivered via malicious advertisements or phishing emails -- the virus spreads throughout their systems. Viruses can modify computer functions and applications; copy, delete and steal data; encrypt data to perform ransomware attacks; and carry out DDoS attacks.

The Zeus virus, first detected in 2006, is still used by threat actors today. Attackers use it to create botnets and as a banking Trojan to steal victims' financial data. The Zeus creators released the malware's source code in 2011, enabling new threat actors to create updated, more threatening versions of the original virus.

Malware comes in many forms, including adware, ransomware and worms.

2. Worms

A computer worm self-replicates and infects other computers without human intervention. This malware inserts itself in devices via security vulnerabilities or malicious links or files. Once inside, worms look for networked devices to attack. Worms often go unnoticed by users, usually disguised as legitimate work files.

WannaCry, also a form of ransomware, is one of the most well-known worm attacks. The malware took advantage of the EternalBlue vulnerability in outdated versions of Windows' Server Message Block protocol. In its first year, the worm spread to 150 countries. The next year, it infected nearly 5 million devices.

3. Ransomware

Ransomware encrypts files or devices and forces victims to pay a ransom in exchange for reentry. While ransomware and malware are often used synonymously, ransomware is a specific form of malware.

There are four main types of ransomware:

Locker ransomware completely locks users out of their devices.
Crypto ransomware encrypts all or some files on a device.
Double extortion ransomware encrypts and exports users' files. This way, attackers can receive payment from the ransom and/or the selling of the stolen data.
Ransomware as a service enables affiliates, or customers, to rent ransomware. A percentage of each ransom is paid to the ransomware developer.

Well-known ransomware variants include REvil, WannaCry and DarkSide, the strain used in the Colonial Pipeline attack.

Data backups were long the go-to defense against ransomware -- with a proper backup, victims could restore their files from a known-good version. With the rise of extortionware, however, organizations must follow other measures to protect their assets from ransomware, such as deploying advanced protection technologies and using antimalware with anti-ransomware features.

4. Bots

A bot is a self-replicating malware that spreads itself to other devices, creating a network of bots, or a botnet. Once infected, devices perform automated tasks commanded by the attacker. Botnets are often used in DDoS attacks. They can also conduct keylogging and send phishing emails.

Mirai is a classic example of a botnet. This malware, which launched a massive DDoS attack in 2016, continues to target IoT and other devices today. Research also shows botnets flourished during the COVID-19 pandemic. Infected consumer devices -- common targets of Mirai and other botnets -- used by employees for work or on the networks of employees working on company-owned devices from home enable the malware to spread to corporate systems.

5. Trojan horses

A Trojan horse is malicious software that appears legitimate to users. Trojans rely on social engineering techniques to invade devices. Once inside a device, the Trojan's payload -- or malicious code -- is installed, which is responsible for facilitating the exploit. Trojans give attackers backdoor access to a device, perform keylogging, install viruses or worms, and steal data.

Remote access Trojans (RATs) enable attackers to take control of an infected device. Once inside, attackers can use the infected device to infect other devices with the RAT and create a botnet.

The Emotet banking Trojan was first discovered in 2014. Despite a global takedown at the beginning of 2021, Emotet has been rebuilt and continues to help threat actors steal victims' financial information.

6. Keyloggers

A keylogger is a surveillance malware that monitors keystroke patterns. Threat actors use keyloggers to obtain victims' usernames and passwords and other sensitive data.

Keyloggers can be hardware or software. Hardware keyloggers are manually installed into keyboards. After a victim uses the keyboard, the attacker must physically retrieve the device. Software keyloggers, on the other hand, do not require physical access. They are often downloaded by the victim via malicious links or downloads. Software keyloggers record keystrokes and upload the data to the attacker.

The Agent Tesla keylogger first emerged in 2014. The spyware RAT still plagues users, with its latest versions not only logging keystrokes, but also taking screenshots of victims' devices.

Password managers are particularly helpful in preventing keylogger attacks because users don't need to physically fill in their usernames and passwords, thus preventing them from being recorded by the keylogger.

7. Rootkits

A rootkit is malicious software that enables threat actors to remotely access and control a device. Rootkits facilitate the spread of other types of malware, including ransomware, viruses and keyloggers.

Rootkits often go undetected because, once inside a device, they can deactivate endpoint antimalware and antivirus software. Rootkits typically enter devices and systems through phishing emails and malicious attachments.

To detect rootkit attacks, cybersecurity teams should analyze network behavior. Set alerts, for example, if a user who routinely logs on at the same time and in the same location every day suddenly logs on at a different time or location.

The first rootkit, NTRootkit, appeared in 1999. Hacker Defender, one of the most deployed rootkits of the 2000s, was released in 2003.

8. Spyware

Spyware is malware that downloads onto a device without the user's permission. It steals users' data to sell to advertisers and external users. Spyware can track credentials and obtain bank details and other sensitive data. It infects devices through malicious apps, links, websites and email attachments. Mobile device spyware, which can be spread via Short Message Service and Multimedia Messaging Service, is particularly damaging because it tracks a user's location and has access to the device's camera and microphone. Adware, keyloggers, Trojans and mobile spyware are all forms of spyware.

Pegasus is a mobile spyware that targets iOS and Android devices. It was first discovered in 2016, at which time it was linked to Israeli technology vendor NSO Group. Apple filed a lawsuit against the vendor in November 2021 for attacking Apple customers and products. Pegasus was also linked to the assassination of Saudi journalist Jamal Khashoggi in 2018.

Spyware encapsulates four main threats: adware, keyloggers, Trojans and mobile spyware.

9. Cryptomining malware

Mining -- the process of verifying transactions within a blockchain -- is highly profitable but requires immense processing power. Miners are rewarded for each transaction they validate. Cryptojacking, the action behind cryptomining malware, enables threat actors to use an infected device's resources to conduct verification.

Cisco found 69% of its customers were affected by cryptomining malware in 2020, accounting for the largest category of DNS traffic to malicious sites that year.

XMRig was the most prevalent cryptomining malware in 2020, followed by JSEcoin, Lucifer, WannaMine and RubyMiner.

10. Adware

Adware is software that displays or downloads unwanted advertisements, typically in the form of banners or pop-ups. It collects web browser history and cookies to target users with specific advertisements.

Not all adware is malicious. Software developers use legitimate adware -- with users' consent -- to offset developer costs. Malicious adware can, however, displays ads that may lead to infection when clicked.

Threat actors use vulnerabilities to infect OSes and place malicious adware within preexisting applications. Users might also download applications already corrupted with adware. Alternately, adware can be included in a software bundle when downloading a legitimate application or come pre-installed on a device, also known as bloatware.

Fireball, Gator, DollarRevenue and OpenSUpdater are examples of adware.

Strong cybersecurity hygiene is the best defense against common types of malware attacks. The premise of cyber hygiene is similar to personal hygiene: If an organization maintains a high level of health (security), it avoids getting sick (attacked).

Good cyber hygiene practices that prevent malware attacks include the following: