Software designed to harm, steal, or take unauthorized control of a system.
Malware is the umbrella term for hostile software; the exam expects you to distinguish the families — virus (needs a host file + user action), worm (self-spreads over networks), trojan (disguised, no self-replication), ransomware, rootkit, spyware, adware, and bots. Modern malware is increasingly modular, fileless (living only in memory), and “living off the land” — abusing legitimate tools like PowerShell — which defeats signature-only antivirus and is why behavior-based EDR has become essential.
Malware that encrypts data and demands payment for the decryption key.
Ransomware encrypts data and demands payment for the key, and it has evolved past simple encryption: double extortion exfiltrates data first and threatens to leak it, so good backups alone no longer guarantee safety, and Ransomware-as-a-Service lets low-skill affiliates run campaigns. Offline, immutable backups remain the single most effective recovery control, paired with fast patching, MFA, network segmentation to limit spread, and EDR to catch the intrusion before encryption begins.
Social engineering by email to trick recipients into revealing credentials or running malware.
Phishing is social engineering by email to harvest credentials or deliver malware, and it remains one of the most common initial-access vectors for breaches. Know the variants: spear phishing targets a specific individual with tailored detail, whaling targets executives, and business email compromise (BEC) impersonates a trusted party to authorize payments. Layered defenses — email filtering, user training, and especially phishing-resistant MFA (FIDO2) — neutralize most credential-harvesting attempts even when a user is fooled.
Voice phishing — social engineering over the phone.
Vishing is voice phishing — social engineering over a phone call, exploiting the pressure and authority a live caller can project. Classic scripts include fake tech-support warnings and “bank fraud department” calls that walk victims into surrendering codes or installing remote-access tools. The defense is process, not detection: verify any unsolicited request by calling back a known-good number. Voice-cloning AI now lets attackers impersonate a specific boss or family member, making caller-ID skepticism essential.
SMS phishing — social engineering by text message.
Smishing is phishing delivered by SMS/text, exploiting the trust and immediacy of mobile messages and the difficulty of inspecting links on a phone. Common lures impersonate banks, parcel-delivery services, or a “CEO” urgently requesting gift cards. Because mobile clients hide full URLs and security tooling is thinner on phones, defenses lean on user awareness, carrier spam filtering, and a policy of never acting on links or requests received by text.
Malware disguised as legitimate software that delivers a hidden payload when run.
A trojan masquerades as legitimate software and runs a hidden malicious payload when the user is tricked into executing it. The defining trait — and a favorite exam point — is that trojans do not self-replicate, which separates them from viruses (need a host file) and worms (spread themselves over networks). Remote Access Trojans (RATs) are a potent variety, giving the attacker persistent, interactive control of the victim’s machine.
Self-replicating malware that spreads across networks without user interaction.
A worm self-replicates and spreads across networks with no user interaction, typically by exploiting a vulnerable network service — which is what lets it propagate explosively. Because it needs no host file or user action (unlike a virus), the controls that matter are fast patching, network segmentation to contain spread, and disabling unneeded services. WannaCry (exploiting EternalBlue) and Conficker are the textbook examples of worm outbreaks.
Malware that attaches to a host file and spreads when the host is executed.
A virus attaches itself to a host file or program and spreads only when that host is executed — so unlike a worm, it requires user action to propagate. Common variants include boot-sector (infects startup code), macro (rides in Office documents), and polymorphic/metamorphic viruses that mutate their code to evade signature detection. Behavior-based EDR and disabling document macros are key modern defenses.
Malware that gains and hides privileged access at the kernel or firmware level.
A rootkit gains privileged (kernel or firmware) access and then hides itself, the attacker’s processes, files, and network connections from the operating system — which is exactly why the OS’s own tools can’t be trusted to find it. Detection relies on offline scanning from known-good media, memory forensics, and integrity/attestation checks. The worst variants live in UEFI firmware or the boot process and survive OS reinstalls; Secure Boot and measured boot are the primary mitigations.
Software that secretly collects information about the user or system.
Spyware covertly gathers information about a user or system — browsing habits, credentials, files — and exfiltrates it to an attacker. Keyloggers are a high-impact subtype, and consumer spyware often rides along with “free” downloads. At the extreme, commercial/mercenary spyware like Pegasus uses zero-click, zero-day exploits to compromise fully patched phones in targeted surveillance, blurring the line between criminal malware and state tooling.
Software that displays unwanted advertising and may also collect tracking data.
Adware is usually low-severity nuisance software, but it lives on a spectrum — aggressive variants bundle tracking spyware or act as droppers for more serious payloads. It typically arrives through deceptive “free” app installers and bundled downloads, which is why scrutinizing install dialogs (declining bundled extras) and using reputable software sources are the front-line defenses.
A network of compromised devices remotely controlled by an attacker.
A botnet is a fleet of compromised devices (“bots” or “zombies”) under an attacker’s command-and-control (C2), monetized through DDoS, credential stuffing, spam, and crypto-mining. Detection often comes from spotting unusual outbound C2 traffic — beaconing to unfamiliar hosts on a regular interval. IoT botnets like Mirai grew huge by exploiting weak default credentials on cameras and routers, which is why changing defaults and segmenting IoT matters.
More Threats, Vulnerabilities, and Mitigations study sets