![1.00](https://firebasestorage.googleapis.com/v0/b/cyberprep-app.firebasestorage.app/o/noteImages%2Fcyberprep%2F1757669009857-image.png?alt=media\&token=18af771e-83f2-4c86-9b37-97099cf61593) **Malware** (malicious software) refers to any software intentionally designed to cause damage, gain unauthorized access, or disrupt normal operations. It can spread through emails, downloads, infected websites, compromised USB devices, or more sophisticated cyberattack campaigns. Detection relies heavily on identifying behavioral or forensic evidence, known as indicators of compromise (IoCs). For your Security+ exam, **you should be familiar with common malware infections and attacks, especially the IoCs and mitigation methods**. The table below contains a summarized view: | Malware | IoCs | Mitigation | | :---------- | :------------------------------------------------------------------------------------------- | :----------------------------------------------------------------------------------------------------------- | | Virus | Missing files, worse performance | Antivirus tools, quarantining and restoring infected files | | Worms | Excessive Network traffic, simultaneous infection | Network Isolation, patching | | Trojan | Strange network connections, unknown processes | Scanning and removal with anti-malware tools, credential resets | | Ransomware | Locked files or systems, warning popups asking for payments | Restoring data from offline, uncompromised backups | | Spyware | Unexplained system slowdowns, altered settings, or data leaks | Thorough malware scans, operating system reinstallation | | Adware | Pop-ups, redirected search results, or unwanted toolbars | Uninstalling unwanted software, resetting browsers, scanning with anti-adware | | Rootkits | Difficult to detect! | Reimaging the system or using secure boot mechanisms | | Logic Bombs | Data deletion or corruption, service disruption | Strict access controls, immediate revocation of access | | Keyloggers | Unexplained system slowdowns, altered settings, or data leaks | Thorough malware scans, operating system reinstallation | | Bloatware | Consume system resources, slow performance | Removing unused applications, deploying group policies | Do not hesitate to continue reading below to have an in-depth look at each type: ## Viruses **Viruses** are among the oldest forms of malware and work by attaching themselves to legitimate files or applications. When these files are executed, the virus activates and can spread to other files or systems, often causing damage or corruption. One of the most famous examples is the **ILOVEYOU** virus from the year 2000, which spread through email and infected millions of systems worldwide by overwriting important files and propagating itself through users’ contact lists. Indicators of infection may include unusual file size changes, frequent system crashes, or executable files failing to open properly. Mitigating a virus infection typically involves scanning with updated antivirus tools, quarantining infected files, and restoring from clean backups if necessary. ## Worms **Worms**, unlike viruses, do not require a host file to spread. They self-replicate and propagate across networks by exploiting vulnerabilities, often without any user interaction. A prime example is the **WannaCry** ransomware worm from 2017, which exploited a vulnerability in Microsoft’s SMB protocol, infecting hundreds of thousands of computers globally within a single day. While the payload was ransomware, its method of self-replication defined it as a worm. Infected systems may exhibit signs like excessive network traffic or simultaneous infections across several machines. To contain such threats, infected machines must be isolated from the network, and unpatched systems should be updated immediately. ## Trojans **Trojans** (referred to by the name of the Trojan horse) are deceptive programs that masquerade as legitimate software but contain harmful code. They often serve as a delivery method for other malware or backdoors, allowing attackers persistent access to the system. A historic example is the Zeus Trojan, discovered in 2007, which was used extensively to steal banking credentials through phishing campaigns. Affected machines may exhibit strange network connections, the presence of unknown processes, or system slowdowns. Mitigation includes scanning and removal with anti-malware tools, credential resets, and forensic analysis to determine if any data was exfiltrated. ## Ransomware **Ransomware** encrypts a victim’s files and demands a ransom—usually in cryptocurrency—in exchange for a decryption key. It’s especially destructive in enterprise environments, where operational downtime can cost millions. **CryptoLocker** in 2013 marked the beginning of the modern ransomware era, while **Ryuk**, active from 2018 onward, targeted large corporations and healthcare providers, demanding high payments. Common indicators include encrypted files with strange extensions, the appearance of ransom notes, and a sudden inability to access personal or shared documents. Immediate mitigation involves isolating infected systems, avoiding payment (if possible), and restoring data from offline, uncompromised backups. ## Spyware **Spyware** is designed to covertly collect information about users or organizations, such as keystrokes, browsing habits, or credentials. One of the most well-known spyware tools is FinFisher, a commercial product sold to governments for surveillance purposes, which has been criticized for being used against dissidents and journalists. Infections may lead to unexplained system slowdowns, altered browser settings, or data leaks. Mitigating spyware involves performing thorough malware scans, often with specialized tools, and in some cases reinstalling the operating system to ensure full removal. ## Adware **Adware**, though often dismissed as merely annoying, can compromise privacy and system performance. It usually comes bundled with freeware and displays unwanted ads, often collecting user data in the process. In 2017, the Fireball adware campaign was discovered on over 250 million systems worldwide, with capabilities far beyond simple advertising, including executing arbitrary code. Systems infected with adware may suffer from pop-ups, redirected search results, or unwanted toolbars. Removing adware involves uninstalling unwanted software, resetting browsers, and scanning with anti-adware utilities. ## Rootkits Rootkits are especially dangerous because they allow attackers privileged access while hiding their presence from detection tools. One of the earliest public controversies involving a rootkit was the Sony BMG case in 2005, where a DRM scheme installed a rootkit on users’ computers via music CDs. They often reside in the kernel or firmware and can disable security software, alter logs, or open backdoors for further attacks. Detection requires specialized rootkit scanners, and mitigation typically demands reimaging the system or using secure boot mechanisms. ## Logic Bombs **Logic bombs** are pieces of code that lie dormant until triggered by a specific condition, such as a date, a user action, or the removal of an employee account. Unlike worms or viruses, logic bombs are often planted by insiders. A famous real-world case was the Omega Engineering sabotage in 1992, where a fired employee planted a logic bomb that erased manufacturing programs, costing the company millions. Systems affected may behave normally until the trigger is activated, after which data deletion, corruption, or service disruption may occur. Preventing and mitigating logic bombs relies on strict access controls, continuous monitoring, and the immediate revocation of access for departing employees. ## Keyloggers **Keyloggers**, often part of spyware, record every keystroke made by a user. Once installed, they can silently capture usernames, passwords, and other sensitive data. These can be hardware-based (e.g., a modified USB keyboard) or software-based and are notoriously hard to detect without endpoint monitoring. The signs that a system is infected by spyware are thus the same as the ones from spywares. ## Bloatware Though not technically malware, **bloatware** deserves mention. It refers to unnecessary or unwanted software that comes pre-installed on new devices or bundled with other applications. While not always harmful, bloatware can consume system resources, slow performance, and, in some cases, introduce security vulnerabilities. Mitigation includes using clean OS installations, removing unused applications, and deploying group policies to limit the installation of unauthorized software.

Welcome to our demo