Principles of Information Security: Malware Types (Viruses, Worms, Ransomware, Trojans, Rootkits)

Malware Types (Viruses, Worms, Ransomware, Trojans, Rootkits)

Malware Types Study Guide: Viruses, Worms, Ransomware, Trojans, Rootkits

For CISSP, Security+, CEH, and Real-World Defense

What This Is

Malware (malicious software) is any code designed to harm, exploit, or infiltrate systems without consent. It’s the #1 threat vector in breaches (Verizon DBIR 2023) and costs organizations $4.45M per incident (IBM Cost of a Data Breach 2023). Example: The 2017 WannaCry ransomware (via EternalBlue exploit) crippled the UK’s NHS, encrypting 200,000+ systems across 150 countries. Understanding malware types helps you detect, respond, and prevent attacks—critical for certifications and SOC roles.

Key Terms & Concepts

• Malware: Malicious software – umbrella term for harmful programs (viruses, worms, ransomware, etc.).
• Virus: Self-replicating code that attaches to clean files (e.g., .exe, .doc) and spreads when executed. Requires user action (e.g., opening an infected email attachment). Example: ILOVEYOU virus (2000) – spread via email, overwrote files, caused $10B in damage.
• Worm: Self-replicating malware that spreads autonomously over networks (no user action needed). Exploits vulnerabilities (e.g., EternalBlue for WannaCry). Example: Morris Worm (1988) – first major worm, crashed 10% of the internet.
• Ransomware: Malware that encrypts files and demands payment (usually cryptocurrency) for decryption. Often delivered via phishing or exploit kits. Example: LockBit, REvil (double extortion: steal + encrypt data).
• NIST SP 800-83 (Guide to Malware Incident Prevention) recommends offline backups and least privilege.
• Trojan (Trojan Horse): Malware disguised as legitimate software (e.g., fake antivirus, cracked games). Often creates backdoors for attackers. Example: Emotet – banking Trojan turned malware loader.
• Rootkit: Malware that hides its presence by modifying OS functions (e.g., kernel, bootloader). Grants privileged access (root/admin). Example: Sony BMG rootkit (2005) – hid DRM software, exposed users to attacks.
• MITRE ATT&CK T1014 (Rootkit) lists techniques like DLL injection and direct kernel object manipulation (DKOM).
• Spyware: Malware that secretly monitors user activity (keyloggers, screen capture). Example: Pegasus – targets mobile devices via zero-click exploits.
• Adware: Malware that displays unwanted ads (often bundled with free software). Can degrade performance or redirect to malicious sites.
• Fileless Malware: Resides in memory (not disk), evading traditional AV. Uses PowerShell, WMI, or macros. Example: Astaroth – abused Windows tools to steal credentials.
• Polymorphic Malware: Changes its code signature to evade detection (e.g., encrypts itself with a new key each time). Example: Virlock ransomware.
• Zero-Day Exploit: Attack targeting a previously unknown vulnerability (no patch available). Example: Stuxnet (2010) – exploited 4 zero-days to sabotage Iran’s nuclear program.
• C2 (Command & Control): Infrastructure used by attackers to control infected hosts (e.g., botnets). Often uses DNS tunneling or HTTPS to evade detection.
• OWASP Top 10 A07:2021 (Identification and Authentication Failures) includes C2 as a risk.

Step-by-Step: Malware Defense & Response

Follow this process to detect, contain, and eradicate malware:

1. Prevention (Before Infection)
2. Patch management: Apply critical updates (e.g., CVE-2021-44228 Log4j) within 48 hours (NIST SP 800-40).
3. Least privilege: Restrict user/admin rights (e.g., Windows LAPS for local admin passwords).
4. Email security: Deploy SPF/DKIM/DMARC to block phishing (primary ransomware delivery vector).

5. Endpoint protection: Use EDR/XDR (e.g., CrowdStrike, SentinelOne) + application whitelisting (e.g., Microsoft AppLocker).

6. Detection (During Infection)

7. SIEM alerts: Monitor for unusual process execution (e.g., powershell.exe spawning cmd.exe).
8. Network traffic: Look for C2 callbacks (e.g., DNS requests to known malicious domains).

9. Behavioral analysis: Detect lateral movement (e.g., Pass-the-Hash attacks) via MITRE ATT&CK techniques.

10. Containment (Stop the Spread)

11. Isolate infected systems: Disconnect from network (use VLAN segmentation or firewall rules).
12. Kill malicious processes: Use Task Manager (Windows) or kill -9 (Linux) for suspicious PIDs.

13. Block IOCs: Add hashes, IPs, domains to blocklists (e.g., MISP, AlienVault OTX).

14. Eradication (Remove Malware)

15. Forensic imaging: Capture memory (volatility) and disk (FTK Imager) for analysis.
16. Clean or rebuild: Wipe and reinstall OS if rootkit is suspected (rootkits are hard to remove).

17. Restore from backups: Use immutable backups (e.g., AWS S3 Object Lock) to recover from ransomware.

18. Recovery (Restore Operations)

19. Validate integrity: Scan restored systems with AV/EDR (e.g., Windows Defender ATP).
20. Monitor for reinfection: Watch for persistence mechanisms (e.g., scheduled tasks, registry keys).

21. Post-incident review: Update playbooks and threat intelligence (e.g., STIX/TAXII feeds).

22. Lessons Learned (Prevent Future Attacks)

23. User training: Simulate phishing tests (e.g., KnowBe4, PhishMe).
24. Threat hunting: Proactively search for IOCs (e.g., YARA rules for malware signatures).
25. Red team exercises: Test defenses with penetration tests (e.g., Metasploit, Cobalt Strike).

Common Mistakes

Certification Exam Tips

1. CISSP Trap:
2. Question: "Which malware type requires user interaction to spread?"
3. Trick: Many pick worms (incorrect) because they’re "self-spreading." The answer is viruses (require execution).

4. Management vs. Technical: CISSP focuses on risk management (e.g., "Which control reduces ransomware impact?") over technical details.

5. Security+ Focus:

6. Common Question: "What’s the primary difference between a virus and a worm?"
7. Answer: User action (virus) vs. autonomous spread (worm).

8. Ports to Know: Ransomware often uses TCP 445 (SMB) or TCP 3389 (RDP) for lateral movement.

9. CEH Perspective:

10. Hands-On: Know how to create a Trojan (e.g., msfvenom) and evade AV (e.g., Veil Framework).
11. Question: "Which tool detects rootkits?"

12. Answer: GMER, RootkitRevealer (but rebuilding the system is safer).

13. All Certs:

14. ⚠️ Watch for "primary purpose" questions. Example:
    • "What’s the primary purpose of a rootkit?" → Hide attacker presence (not steal data).
15. Ransomware vs. Crypto-Malware: All ransomware is crypto-malware, but not all crypto-malware is ransomware (e.g., cryptojacking mines Monero).

Quick Check Questions

1. Scenario: A user reports their files are encrypted with a .locked extension, and a text file demands Bitcoin payment. Which malware type is this, and what’s the first containment step?
2. Answer: Ransomware. First step: Isolate the infected system (disconnect from network).

3. Explanation: Prevents lateral movement to other systems.

4. Scenario: An attacker sends a fake "invoice.pdf.exe" file to employees. When opened, it installs a backdoor. What’s the malware type, and which MITRE ATT&CK technique does this demonstrate?

5. Answer: Trojan. Technique: T1204 (User Execution).

6. Explanation: Trojans rely on social engineering (e.g., disguising as legitimate files).

7. Scenario: A SOC analyst notices svchost.exe making DNS requests to a known malicious domain. Memory analysis reveals no disk-based malware. What’s the likely malware type, and which NIST control would help detect it?

8. Answer: Fileless malware. NIST control: SI-4 (System Monitoring).
9. Explanation: Fileless malware operates in memory, evading traditional AV.

Last-Minute Cram Sheet

1. Virus = Needs user action to spread (e.g., open file).
2. Worm = Self-spreading (no user needed; exploits vulnerabilities).
3. Ransomware = Encrypts files + demands payment (e.g., WannaCry, LockBit).
4. Trojan = Disguised as legit software (e.g., fake games, "invoice.exe").
5. Rootkit = Hides in OS kernel (hard to detect; often requires rebuild).
6. Fileless malware = Runs in memory (e.g., PowerShell, WMI abuse).
7. Polymorphic malware = Changes code to evade signature-based AV.
8. Zero-day = Unpatched vulnerability (no fix available).
9. C2 (Command & Control) = Attacker’s remote control channel (e.g., DNS tunneling).
10. ⚠️ Exam Trap: All ransomware is crypto-malware, but not all crypto-malware is ransomware (e.g., cryptojacking).

Final Tip: For exams, memorize the "primary purpose" of each malware type (e.g., rootkit = hide, worm = spread). For real-world roles, focus on detection/response (EDR, SIEM, backups).