The Different Types of Malware

Regardless of how familiar you are with Information Security, you’ve probably come across the term ‘malware’ countless times. From accessing your business-critical resources and sensitive information to halting business operations and services, a malware infection can quickly become an organization’s worst nightmare come true.
 
As a business owner, you must be aware of the implications of different types of malware on your company’s bottom line, and what steps you can take to protect your company from future attacks. This article will walk you through the various types of malware, how to identify and prevent a malware attack, and how to mitigate the risks.
 
What is Malware?
 
Malware, a combination of the terms ‘malicious’ and ‘software,’ includes all malicious programs that intend to exploit computer devices or entire network infrastructures to extract victim’s data, disrupt business operations, or simply, cause chaos. There’s no definitive method or technique that defines malware; any program that harms the computer or system owners and benefits the perpetrators is malware. 
 
A malware usually exploits unpatched software vulnerabilities to compromise an endpoint device and gain a foothold in an organization’s internal network. 
 
It could be hidden in a malicious advertisement, fake email or illegitimate software installation. Cyber criminals often leverage social engineering tactics like phishing and spear-phishing to propagate sophisticated malware. 
From mining crypto currency to launching DDoS attacks against networks, there are countless ways in which malware can access and utilize victim’s computers and data.
 
Warning Signs of Malware Infection
 
How often have you ignored unusual system slowdowns or unexpected pop-up messages? 
Unfortunately, this could be your computer trying to give away the presence of malware. To stop a malware attack in its tracks, you must first be able to identify an infection. 
 
Here are some of the key signs that almost always indicate malware progressing in your computer system:
 
• Your computer starts running slowly and takes forever to boot.
• Your computer screen freezes or the system crashes, displaying the ‘Blue Screen of Death” (BSOD)
• Your web browser keeps redirecting you to unknown, suspicious websites. 
• Security warnings keep popping up, urging you to take immediate action or install a particular security product. 
• Many pop-up ads start appearing randomly.
 
All of these could be typical signs of malware. The more symptoms you see, the more likely it is that you’re dealing with an infected computer. 
 
But don’t just solely rely on the list included above. It is not unusual to have your system or network infected with malware, such as spyware, that often lingers secretly with no apparent symptoms. Don’t worry though. We’ll be discussing how to detect and remove malware silently lurking in your system, exfiltrating sensitive data.
 
Common Types of Malware
 
Malware can be categorized based on how it behaves (adware, spyware and ransomware), and how it propagates from one victim to another (viruses, worms and trojans). For instance, computer worms are self-propagating malicious software, while
trojans need user activation to infect and spread. 
 
Here are a few of the most common malware types that most people have heard of, and how they continue to wreak havoc across industries.
 
1. Adware  If you’re lucky, the only malware program you’ve come in contact with is adware, which attempts to expose the compromised end-user to unwanted, potentially malicious advertising. A common adware program might redirect a user’s browser searches to look-alike web pages that contain other product promotions. Statistics gathered between October and December 2019 by Avast’s Threat Lab experts show that adware was responsible for 72% of all mobile malware, and the remaining 28% consisted of banking trojans, fake apps, lockers, and downloaders.
 
2. Spyware  Spyware can silently infect a computer, mobile device or tablet, trying to collect keystrokes, gather sensitive data, or study user behavior, all the while victims remain entirely unaware of the intrusion. Hackers may use a keylogger to capture sensitive information, including payment details and login credentials of victims, or they may leverage a screen grabber to capture internet activity. A common type of spyware is a RAM scraper that attacks the storage (RAM) of electronic point-of-sale (POS) devices to scrap customers’ credit card information. One of the most notorious one being the BlackPOS spyware that compromised the data of over 40 million Target customers in 2013.
 
3. Ransomware  Ransomware is one of the most widespread cyber threats, making up at least 27% of all malware incidents as per Verizon’s annual DBIR report (2020). Ransomware programs gain access to a computer’s file system and execute a payload to encrypt all data. The data is neither stolen nor manipulated. Shortly after a ransomware attack, cyber criminals will demand a ransom amount, usually in crypto currency, in exchange for the cipher key. WannaCry 2017 is well-known for the stir and panic it caused in May 2017 by affecting thousands of NHS hospitals, delaying critical medical procedures, and rerouting ambulances. The ransomware leveraged a Microsoft exploit, EternalBlue, which already had a patch that many conveniently did not apply. Unfortunately, most of the data it encrypted was lost for good due to faulty code.
 
4. Computer Viruses  A virus is the most commonly known form of malware. It differs from other malware in its ability to attach to a host file and infect other files on the computer system. It copies itself whenever the file is copied, and once a user opens the file, the virus payload is executed. Viruses can be highly destructive, infecting the hard drive on victim’s computers and overwriting or exfiltrating critical information. Email attachments are the top vector leading to virus infections. Computer viruses often utilize deception techniques and keep evolving to evade antivirus software. Viruses like CIH (Chen lng-hau) do not increase the file size of the host file, thus becoming undetectable for antivirus programs that detect viruses based on the file size.
 
5. Computer Worms  A worm is quite similar to a computer virus, except it is a standalone software that does not rely on a host file or a user to propagate itself.  A worm is self-replicating and can quickly spread across computer networks by distributing itself to the victim’s contact list and other devices on the same network. A firewall can be effective in stopping the spread of worms through network endpoints. However, anti malware is required for detecting worms disguised as email attachments. NotPetya shook the entire world in June 2017. It was undisputedly the fastest spreading, most destructive worm that crippled hospitals, multinational companies and pharmaceutical giants globally by irreversibly encrypting systems’ master boot records.
 
6. Trojan Horse  A trojan horse is a malware program that advertises itself as legitimate software and tricks users into downloading and executing it. Once activated, it can harm the victim’s computer in several ways, including keylogging. 
Mostly, it can create a backdoor to bypass firewalls and security software to give remote access to unauthorized users who can steal data and control the computer system. Trojans cannot self-replicate and are often propagated through email attachments and internet downloads. The backdoor trojan, PlugX malware, compromised around 7.93 million customer records from a Japanese travel agency, JTB Corp, in July 2016. And it all started with a single employee falling prey to a phishing email.
 
7. Botnets  A botnet is a network of internet-connected ‘zombie’ computers that can execute coordinated actions after receiving commands from a centralized server.  Bots secretly infect a computer, which then becomes a part of the bot network. They can be used to launch spam emails and distributed denial of service (DDoS) attacks, leveraging hundreds of thousands of compromised computers. Conficker, or Downadup, is a fast-propagating malware discovered in November 2008. Over the years, it has infected millions of computers to create a botnet. Cybercriminals can utilize the botnet to carry out malicious activities, such as phishing, identity theft and bypassing security to access private networks.
 
Less Common Types of Malware
 
In addition to the types discussed above, there are many other types of malware that are less common but equally destructive.
 
1. Rootkit  A rootkit is a collection of software tools that can gain access to an operating system and assume administrative privileges.  It can use the acquired privileges to facilitate other types of malware infecting a computer. Moreover, it can also take over browsing sessions to prevent access to webpages with antimalware programs.
 
2. Fileless Malware  Fileless malware is a malicious code that exploits legitimate software programs and operating system tools to infect a computer’s memory. As the name suggests, it does not need a file system to spread, and therefore, leaves no trace for detection through traditional anti malware programs.
 
3. Scareware Scareware is basically a scam used by attackers to trick victims into thinking that their computers or mobile devices have been compromised.  It typically displays pop-ups on webpages to scare a user into purchasing and installing fake, potentially harmful, security software. Today, bad actors often launch cyber attacks that are a combination of several malware types.  For instance, a worm could quickly self-replicate and deliver an executable to encrypt file systems across computer networks and launch massive ransomware. These hybrid forms of malware are even harder to detect, contain and remove.
 
How to Protect Your Business From Malware
 
The threat landscape is ever-evolving, and so are the security mechanisms. With malware becoming more sophisticated than ever, businesses must stay ahead of the cybersecurity game by ensuring that:
 
 
• All business applications and operating systems are always up-to-date, and available patches for known software vulnerabilities are installed.
• Antimalware scans are run regularly across all devices that access the internal network. 
• Employees only install apps and software that they actually need from legitimate sources. 
• Mobile devices that access the private network are also well-equipped with mobile security solutions.
• Single Sign-on (SSO) and Multi-factor Authentication (MFA) mechanisms are implemented to protect against keylogging.
• In flexible working or bring your own device (BYOD) environments, employees have separate PCs for work and personal use.
• Employees are aware of the cybersecurity best practices, and regular security awareness workshops are conducted. 
• Employees are knowledgeable enough to spot a phishing email and double-check before providing sensitive information. 
• Your organization has invested in Security Information and Event Management (SIEM) software to aggregate and analyze event logs generated by network and apps.
• If you work with an MSP (Managed Service Provider), make sure they are also a Managed IT Security Provider. Certain certifications will help you identify whether or not they can provide a high level of security including, but not limited to:
• Certified Informations Systems Security Professional (CISSP)
• AICPA Service Organization Control Reports SOC 2 Certification
• MSP Alliance Cyber Verify AAA Rated Company
 
How to Get Rid of Malware
 
No single security program is enough for malware that is known to morph and evolve rapidly to avoid detection.  With today’s virtually endless endpoint devices and huge attack surface, security incidents are inevitable.  A reputable enterprise anti malware program can detect an installed malware, quarantine the infected device to avoid transmission, and remove the malware.  But let’s not forget that preventing a malware infection altogether is much easier than getting rid of it once it has infiltrated your IT infrastructure. The best course of action is to adopt a proactive approach to cybersecurity. 
 
Ashley Lukeheart is Co-founder Parachute Technology 
 
You Might Also Read:
 
Most Large Financial Firms Have Been Attacked In The Past Year:
 
« The Impact of Covid-19 On Cyber Security Threats
The SolarWinds Hack Can Directly Affect Industrial Control Systems »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Arcitura Education

Arcitura Education

Arcitura is a leading global provider of progressive, vendor-neutral IT training and certification programs.

CLUSIS

CLUSIS

CLUSIS is an association for the information security industry in Switzerland.

Deltagon

Deltagon

Deltagon develops information security solutions to protect companies’ confidential information in e-communication and e-services.

Lanner Electronics

Lanner Electronics

Lanner Electronics is a leading hardware provider for advanced network appliances and industrial automation solutions including cyber security.

NetExtend

NetExtend

NetExtend services include backup and recovery, endpoint protection, network monitoring, cloud portal and billing and payment solutions.

RunSafe Security

RunSafe Security

RunSafe Security is the pioneer of a patented cyberhardening transformation process designed to disrupt attackers and protect vulnerable embedded systems and devices.

Securicon

Securicon

Securicon provides expert consulting for application, system and network security.

Kapalya

Kapalya

Kapalya empowers businesses and their employees to securely store sensitive files at-rest and in-transit across multiple platforms through a user-friendly desktop and mobile application.

Micro Strategies Inc.

Micro Strategies Inc.

Micro Strategies provides IT solutions that help businesses tackle digital transformation in style.

HSB

HSB

HSB offers insurance for equipment breakdown, cyber risk, data breach, identity recovery & employment practices liability.

FiVerity

FiVerity

FiVerity provides financial institutions with cyber fraud defense to combat a dangerous and growing threat - the convergence of fraud-related theft with sophisticated, high-volume cyber attacks.

APCERT

APCERT

APCERT cooperates with CERTs and CSIRTs to ensure internet security in the Asia Pacific region, based around genuine information sharing, trust and cooperation.

ConductorOne

ConductorOne

ConductorOne is building the identity security platform for the modern workforce.

Cognna

Cognna

Cognna's innovative platform is designed to empower you and your team, providing the tools you need to detect, prevent, and resolve threats with ease.

Security Awareness Special Interest Group (SASIG)

Security Awareness Special Interest Group (SASIG)

The Security Awareness Special Interest Group (SASIG) addresses the human aspects of security and fraud prevention in an initiative to improve trust and confidence in the online environment.

Tausight

Tausight

Tausight is an AI-Powered patient data security startup with a mission of reducing healthcare cyber incidents using a more proactive, risk management philosophy.