Malware gets to computers through a variety of methods, including fake invoices, compromised browser extensions, and exploitation of exposed remote services. Malware can also arrive through a seemingly legitimate installer that silently captures passwords and logins.
Identifying different types of malware is beneficial to security professionals planning for detection, containment, recovery and investigation of an incident. Different types of malware exhibit different behavior patterns that impact how rapidly it will spread throughout your network and how long it remains on your network to collect credentials or provide the next attacker access to your internal environment. Simply identifying the form of malware will not lower the risk of being victimized by it. Therefore, every enterprise must create control points that identify and relate to each entry point, operating mechanism, and manner in which threats operate.
Why Malware Classification Still Matters
Security teams will frequently categorize malicious files under a general alert category for ease of viewing. While easier to view on a dashboard, it is generally less helpful during an investigation.
How? Because the discussion changes depending on the types of malware. For example:
- A ransomware alert calls for rapid isolation and recovery decisions.
- An infostealer infection raises questions about exposed credentials, browser sessions, and access tokens.
- A backdoor might point to a much longer compromise, perhaps involving lateral movement or data collection that began well before the alert fired.
Malware classification determines the reaction to the alert and assists chief information security officers (CISOs) in explaining risk in operational terms. Rather than stating that “malware activity has increased”, teams can demonstrate which attack vectors are increasing in frequency, which controls were unsuccessful and where spending is warranted. This provides a more concrete basis for the budget discussions.
Common Types of Malware and How They Behave
Before refining detection and response plans, security teams need a breakdown of types of malware and the distinct behaviors associated with each category. The name attached to an infection matters less than what it reveals about persistence, propagation, data access, and likely attacker objectives.
Ransomware
Ransomware either encrypts files or prevents access to a computer system, allowing attackers to use that disruption as leverage for a ransom request. Many modern attackers will steal sensitive information prior to initiating encryption activities and declare they will release such sensitive information unless payment is received.
Therefore, even though the attacker utilized ransomware as part of their process, it is unlikely that it was the original point of entry into your organization. The original entry points may have included the utilization of previously-stolen login credentials, phishing attacks against employees, unauthorized exploitation of an exposed remote access feature or unauthorized exploitation of a previously unpatched internet-exposed system. Upon gaining entry into the organization, attackers may choose to disable existing security tools, locate backup repositories, and proceed towards high-value servers.
Trojans
Trojan horses can be difficult to identify due to their ability to mimic legitimate software or content with hidden malicious capabilities. Unlike worms, Trojans do not self-replicate as their defining method of spread. A common method by which a Trojan becomes installed on a system is when a user, administrator or deployment process chooses to install or run the disguised software.
Signed installers, shared documents or updates bearing a familiar appearance may pass an initial sniff test. Additional protections above education of users include application control, file reputation, sandbox testing and restrictions placed on administrative rights.
Worms
Worms can independently replicate themselves and disseminate themselves amongst various systems without requiring further interaction from users. Most commonly, worms infect networks through unpatched security vulnerabilities within network services, poor passwords or poorly maintained security configurations.
The speed of these threats is the main containment problem: a single compromise in a flat enterprise network can disrupt many systems prior to the security operations center (SOC) validating its first set of alerts. Isolating infected systems and segmenting networks represent two key aspects of effective containment strategies.
Spyware and Infostealers
Spyware gathers information from devices without the user’s informed consent. An infostealer generally steals information from devices and in some cases will steal browser login credentials; authentication cookies; cryptocurrency wallet data; system details; and stored data associated with installed applications.
An infected laptop may continue to work normally, without displaying a ransom note. An attacker who obtains session tokens may potentially utilize those session tokens without needing to input the password again. If a password reset does not invalidate the session token, the attacker may retain access to the affected systems.
Therefore, simply removing malware from the affected laptop as part of traditional device cleanup efforts is not enough. Teams should promptly revoke active sessions and tokens associated with the affected accounts; rotate credentials that have been exposed; analyze identity logs; and determine if the compromised account was accessed elsewhere.
Rootkits and Bootkits
Rootkits and bootkits are examples of additional types of malware. Rootkits manipulate or exploit low-level system functions to conceal malicious behavior. They may hide processes, files or network connections. A bootkit is malicious software that operates before the operating system begins executing. In addition to concealing malicious behavior, rootkits can make removal via standard methods difficult.
Investigators may need to conduct integrity checks or analyze memory dumps in order to understand how rootkits were used by attackers. The startup process can be protected by implementing trusted boot mechanisms; however, such mechanisms should not be relied upon solely for determining whether an infection has been successfully eliminated. Following preservation of applicable incident-related evidence for analysis purposes, restoration of systems impacted by rootkits may involve restoring systems from known-good media. However, if the firmware was compromised as part of the attack process, merely replacing the operating system may not eliminate the malware.
Bots and Backdoors
Compromised devices may join botnets or provide attackers with backdoors for accessing compromised devices remotely. Once attackers obtain remote access to devices utilizing backdoors or bots, they can provide instructions; deploy additional malware; gather additional information; or utilize compromised devices to engage in distributed denial-of-service (DDoS) attacks against other organizations.
A small beacon transmitted by a single device may be indicative of a broader compromise. When an incident occurs and SOC identifies command-and-control (C2) communications on a user’s workstation, the SOC should not stop after blocking communication with the identified C2 IP address. The SOC should initiate an investigation to identify how attackers gained an initial foothold into the environment; if attackers established any type of persistence; and which additional host(s) have communicated with identical or related C2 infrastructure.
Fileless Malware
Fileless malware relies primarily upon trusted system utilities/services (i.e., PowerShell, Command Prompt, etc.), scripting engines, memory, and normal/legitimate administrative actions; however, fileless malware may leave fewer traditional files available for antivirus scanning.
“Fileless” does not equate to “unobservable”. Process ancestry; command-line activity; network behavior; scripting activity; and anomalous identity event activity are all possible avenues through which fileless malware can be detected; therefore, security teams collecting only file-based indicators of compromise (IoCs) will likely fail to detect fileless threats.
Building Prevention Around Attack Paths
Malware prevention works better when controls are organized around likely entry points rather than product categories.
Start with five practical recommendations:
- Reduce exposed entry points: Patch internet-facing systems quickly, remove unused services, and deploy phishing-resistant multifactor authentication for remote and privileged access.
- Limit execution: Use application control, restrict macros and scripting where they aren’t needed, and stop users from installing unapproved software.
- Contain movement: Segment user, server, backup, development, and administrative environments. Default connectivity often helps the attacker more than the business.
- Protect recovery paths: Keep tested backups isolated from ordinary administrative credentials. A backup that attackers can delete isn’t a recovery control.
- Watch behavior, not just files: Correlate endpoint, identity, email, DNS, firewall, cloud, and authentication events.
The European Union Agency for Cybersecurity’s threat reporting examines ransomware, phishing, supply-chain compromise and other threats in the context of attacker behavior and vulnerabilities.
Similarly, CERT-EU’s mitigation guidance emphasizes asset-focused governance, strong identity controls, system hardening, testing, and detection capability.
Taken together, ENISA’s report and CERT-EU’s guidance support a simple conclusion: no single preventive barrier will support the entire program.
Test Whether the Controls Actually Work
Will the SOC be capable of isolating or containing suspected endpoints before malicious code accesses shared resources? At first glance this appears to be an easy question to answer. However, it is far more complex than it seems.
For example: assume a mid-size company transfers workloads into a hybrid computing environment. While the company maintains endpoint controls on employee laptops, it lacks visibility into unmanaged cloud instances. Due to unclear ownership when an incident occurs, delays in containment may occur. The control exists on paper, yet the operating model is ineffective.
Conduct simulated tests to evaluate actual decision-making:
- Can analysts identify the patient-zero device?
- Are privileged credentials separated from daily user accounts?
- How quickly can active sessions and tokens be revoked?
- Can backup teams restore critical services without relying on the compromised domain?
- Who can authorize network isolation during business hours?
- Are third-party connections included in the investigation scope?
These questions highlight gaps that will not be filled by another malware signature.
Cyber Hygiene Has to Survive Contact With an Incident
Knowing the types of malware helps teams anticipate how an infection may behave. The value provided comes from using that knowledge appropriately. Good cyber hygiene involves ongoing work and is rarely solved by a single purchase. These disciplines consist of continuous patch maintenance; minimizing user privileges; controlling execution of code; segregating your network; protecting backup data; providing meaningful telemetry; and creating and rehearsing incident response procedures with clear authority to act.
When these disciplines work together, malicious code has fewer opportunities to enter the network, persist, and spread.