Malware

Malware is an umbrella term for a wide taxonomy distinguished by propagation and purpose rather than by any single trait. A virus attaches itself to a host file and spreads when that file is executed; a worm is self-propagating and needs no host, historically spreading across networks by exploiting remote services; a trojan masquerades as legitimate software; a rootkit hides its presence by subverting the operating system, sometimes at kernel or firmware level; and a bot enrols the host into a command-and-control (C2) botnet. Ransomware, spyware, keyloggers, cryptominers and wipers are categories defined by payload. Modern samples are usually multi-stage: a small loader or dropper establishes a foothold and then pulls further modules, so the initially delivered file often contains little of the final capability.

Detection has moved through three broad generations. Signature-based antivirus matches known byte patterns or file hashes and is fast but blind to novel or repacked samples; heuristic and static analysis inspect structure and suspicious API imports; behaviour-based endpoint detection and response (EDR) watches runtime actions - process injection, credential access, mass file encryption - and can catch previously unseen malware by what it does. Attackers respond with evasion: packers and crypters that obfuscate the binary, polymorphic and metamorphic code that changes its own form, sandbox-detection that stays dormant under analysis, and increasingly fileless techniques that run entirely in memory or abuse legitimate tools already on the host (the living-off-the-land pattern), leaving little for a file scanner to find.

Delivery today is dominated by phishing attachments and links, malicious or compromised websites (drive-by downloads), trojanised software and updates, and exploitation of unpatched internet-facing services. Once running, malware typically establishes persistence (registry run keys, scheduled tasks, services), beacons to C2 infrastructure over HTTPS or DNS to blend with normal traffic, and may attempt to disable security tooling. The MITRE ATT&CK matrix catalogues these behaviours as techniques, which is why defenders increasingly hunt for behavioural indicators and TTPs rather than relying on static indicators of compromise such as hashes, which change trivially between samples.

Containment rests on layered controls: application allow-listing so only approved binaries execute, least privilege so a payload inherits limited rights, network segmentation to limit spread, prompt patching to close exploited flaws, and tested offline backups so a wiper or ransomware event is recoverable. A common misconception is that malware requires the user to run an executable; macro-enabled documents, script interpreters, browser exploits and supply-chain compromises all execute code without a deliberate double-click. Malware is one mechanism a threat uses; it is distinct from the vulnerability it may exploit to gain entry, and from the human-driven attack techniques, such as lateral movement, that a foothold then enables.