Types of Malware: 16 Kinds Explained With Examples

The main types of malware are viruses, worms, trojans, ransomware, spyware, adware, keyloggers, rootkits, bootkits, infostealers, remote access trojans (RATs), fileless malware, botnets, wipers, cryptojackers and logic bombs. They differ in how they spread (a virus needs a host file, a worm spreads on its own, a trojan relies on a user), how they hide, and what they do once inside: steal data, spy, extort, destroy or borrow your computing power. This guide explains all 16 types with a dated real-world example, the MITRE ATT&CK mapping and the controls that detect and prevent each one.

What Is Malware?

NIST defines malware as software or firmware intended to perform an unauthorized process that will have an adverse impact on the confidentiality, integrity or availability of an information system. The word is short for "malicious software," and it covers everything from a 1990s macro virus to a modern infostealer sold as a subscription service.

Two points make the rest of this guide easier to use:

• Malware types describe behavior, not products. "Worm" describes how something spreads, "rootkit" how it hides and "ransomware" what it does at the end. One real-world family often fits several types at once. WannaCry was both a worm and ransomware; Emotet started as a banking trojan and became a botnet that delivered other malware.
• Malware is one stage of an attack, not the whole attack. It usually arrives through phishing, an exploited vulnerability or stolen credentials, and it is followed by privilege escalation, lateral movement and an objective such as data theft or extortion. Our overview of the types of cyber attacks shows where malware fits among the other attack families.

Security teams map malware behavior to MITRE ATT&CK, a public knowledge base of adversary tactics (the goal of a step) and techniques (how the step is done). ATT&CK also keeps a software catalog with pages for named malware families such as WannaCry (S0366) and Emotet (S0367). This guide uses ATT&CK Enterprise v20 names. In v20 the tactic formerly called Defense Evasion (TA0005) is named Stealth, and a separate Defense Impairment tactic covers disabling security tools. For current infection counts and trend data, see our malware statistics roundup; this page focuses on how each type works.

The 16 Types of Malware at a Glance

Technique names and IDs come from MITRE ATT&CK Enterprise v20, except spyware on phones, which ATT&CK covers in its Mobile matrix. The sources for each example are linked in the type sections below.

Malware That Spreads: Viruses, Worms and Trojans

These three are the oldest and best-known malware types. The difference between them is how they spread: a virus rides on a host file, a worm moves on its own, and a trojan needs the victim to install it.

1. Virus

A computer virus is malicious code that attaches itself to a legitimate file, program or document macro and runs when that host runs. Once active, it copies itself into other files, so it spreads every time an infected file is shared or opened.

• How it spreads: infected executables and documents, shared network drives and removable media. Viruses need a person or process to run the host file.
• Real example: on March 26, 1999 the Melissa virus began spreading across the internet. According to the FBI, it was a Word macro that hijacked Microsoft Outlook to email itself to the first 50 addresses in each victim's mailing list. Email servers at more than 300 corporations and government agencies became overloaded, and about one million email accounts were disrupted.
• ATT&CK mapping: ATT&CK has no single "virus" technique. File infection on shared storage matches Taint Shared Content (T1080), USB spread matches Replication Through Removable Media (T1091), and the first run matches User Execution: Malicious File (T1204.002).
• Detect and prevent: block Office macros in files from the internet through policy, keep antivirus signatures current (classic file infectors are well covered), restrict write access to shared folders and disable autorun for removable media.

"Virus" is often used as a synonym for malware in general. Technically it is just one type, and pure file-infecting viruses are now a small share of what defenders see.

2. Worm

A worm is standalone malware that copies itself from one system to the next without any user action. It finds new targets by scanning for a vulnerable network service or weak credentials, exploits them, and repeats the process from each new host. That is why worms can cross an entire network in hours.

• How it spreads: exploitation of network services, default or weak passwords, open file shares and removable media.
• Real example: WannaCry was discovered on the morning of May 12, 2017 and spread rapidly within hours. CISA's alert TA17-132A reported tens of thousands of infections in over 150 countries. It spread through a critical Windows SMB vulnerability, CVE-2017-0144, for which Microsoft had released the MS17-010 update on March 14, 2017. WannaCry was also ransomware, a good example of one family fitting two types.
• ATT&CK mapping: Exploitation of Remote Services (T1210) under Lateral Movement; ATT&CK tracks the family as WannaCry (S0366).
• Detect and prevent: patch internet-facing and internal services quickly, disable legacy protocols such as SMBv1, block SMB at the perimeter, segment networks so one infected host cannot reach everything, and alert on sudden scanning between internal hosts.

3. Trojan

A trojan (or Trojan horse) is malware disguised as something the victim wants: an invoice, a software update, a game or a free tool. Unlike a virus or worm, it does not copy itself. It relies on the user to install it, then opens the door for the attacker. Many trojans are droppers or loaders whose main job is to download other malware.

• How it spreads: phishing attachments and links, fake download sites, malicious ads and trojanized versions of real software.
• Real example: in an October 2020 alert, CISA and MS-ISAC described Emotet as a sophisticated trojan commonly working as a downloader or dropper for other malware. It spread mainly through phishing emails with Word attachments and links, then tried to move across networks by guessing credentials and writing to shared drives. CISA's intrusion detection system recorded roughly 16,000 Emotet-related alerts on federal civilian networks after the malware resurged in July 2020.
• ATT&CK mapping: User Execution: Malicious File (T1204.002) and Masquerading (T1036) under Stealth; the family is Emotet (S0367).
• Detect and prevent: attachment sandboxing and filtering, macro blocking, application allowlisting, and EDR rules that flag Office or PDF readers launching scripts or command shells. Because trojans arrive by deception, spear phishing awareness and easy reporting matter as much as tooling.

Malware That Extorts or Monetizes: Ransomware, Adware and Cryptojackers

These types exist to make money directly from the victim, either by demanding payment, by selling the victim's attention, or by stealing computing power.

4. Ransomware

Ransomware encrypts an organization's files or systems and demands payment for the decryption key. Most modern groups also steal data first and threaten to publish it (double extortion), so restoring from backup does not end the threat. Many operate as ransomware-as-a-service (RaaS), where developers rent the malware to affiliates who carry out intrusions.

• How it spreads: rarely by itself. Operators usually get in with stolen credentials, an exploited edge device or a phishing-delivered loader, escalate privileges, and deploy ransomware across the network at the end.
• Real example: the FBI, CISA and HHS joint advisory #StopRansomware: ALPHV Blackcat, first issued on December 19, 2023 and updated on February 27, 2024, describes a RaaS operation. It reports that of the nearly 70 victims ALPHV leaked after mid-December 2023, the healthcare sector was the most commonly targeted. Our profile of ALPHV/BlackCat ransomware covers its tactics in depth.
• ATT&CK mapping: Data Encrypted for Impact (T1486) and Inhibit System Recovery (T1490), both under Impact; the family is BlackCat (S1068).
• Detect and prevent: phishing-resistant MFA on remote access and email, fast patching of known exploited vulnerabilities, offline or immutable backups with tested restores, EDR alerts on mass file changes and shadow copy deletion, and a rehearsed incident response plan.

For payment rates, attack volumes and costs, see our ransomware statistics rather than repeating them here.

5. Adware

Adware displays, injects or redirects users to advertising, usually without clear consent. Much adware sits in a gray area between unwanted software and malware, but some versions tamper with browsers or security settings in ways that create real risk.

• How it spreads: bundled with free software, browser extensions, fake updates and, in some cases, software preinstalled by a device maker.
• Real example: on September 5, 2017 the Federal Trade Commission announced a settlement with Lenovo over VisualDiscovery, ad-injecting software from Superfish that was preinstalled on hundreds of thousands of laptops from August 2014. According to the FTC, it acted as a man-in-the-middle between browsers and websites, replaced the certificates of encrypted sites with its own, and used the same easy-to-crack password on every affected laptop, which could let attackers intercept users' communications with any website.
• ATT&CK mapping: ad-injecting browser add-ons map to Software Extensions: Browser Extensions (T1176.001) under Persistence; traffic interception like Superfish's matches Adversary-in-the-Middle (T1557).
• Detect and prevent: allowlist browser extensions through management policy, keep a software inventory for every device, enable potentially unwanted application (PUA) blocking in endpoint protection, and reimage new devices with a clean corporate build.

6. Cryptojacker

A cryptojacker (cryptomining malware) secretly uses a victim's processors, servers or cloud accounts to mine cryptocurrency, usually Monero. It rarely steals data, so it is easy to dismiss, but it shows that an attacker has code execution on your systems and can switch to something worse.

• How it spreads: exploitation of unpatched internet-facing servers, stolen cloud credentials, exposed container and orchestration APIs, and malicious scripts on websites.
• Real example: CISA's advisory AA22-320A (November 2022) describes a federal civilian agency where actors CISA and the FBI assessed as Iranian government-sponsored exploited the Log4Shell vulnerability (CVE-2021-44228) in an unpatched VMware Horizon server, installed XMRig crypto mining software, moved laterally to the domain controller and compromised credentials.
• ATT&CK mapping: Resource Hijacking (T1496) under Impact.
• Detect and prevent: alert on sustained high CPU and unexpected cloud spend, block known mining pool domains and ports at the egress, patch exposed servers, and treat any miner as a full compromise to investigate.

Malware That Spies and Steals: Spyware, Keyloggers, Infostealers and RATs

These types collect information or give an attacker eyes and hands inside a system. They are often the first step toward account takeover, fraud or ransomware.

7. Spyware

Spyware covertly monitors a person or device and sends what it collects to someone else: messages, location, microphone and camera input, screenshots or browsing activity. It ranges from commercial "stalkerware" to mercenary spyware sold to governments.

• How it spreads: exploits against phones and computers (including zero-click exploits that need no user action), malicious apps and bundled software.
• Real example: on September 13, 2021, the University of Toronto's Citizen Lab reported FORCEDENTRY, a zero-click iMessage exploit it found while analyzing a Saudi activist's phone infected with NSO Group's Pegasus spyware. Apple fixed the flaw as CVE-2021-30860, which CISA added to its Known Exploited Vulnerabilities catalog on November 3, 2021. The same day, the U.S. Commerce Department added NSO Group to the Entity List for supplying spyware used against journalists, activists and officials.
• ATT&CK mapping: ATT&CK's Mobile matrix tracks Pegasus for iOS (S0289) and techniques such as Audio Capture (T1429) and Location Tracking (T1430); on desktops, spyware maps to Screen Capture (T1113) and Audio Capture (T1123) under Collection.
• Detect and prevent: install operating system updates quickly, manage corporate phones with mobile device management, restrict app installation to official stores, and offer high-risk staff hardened modes such as Apple's Lockdown Mode.

8. Keylogger

A keylogger records what a user types, so it captures passwords, card numbers and messages before encryption can protect them. Software keyloggers are rarely standalone today; most come built into infostealers and RATs, which also grab clipboard contents and screenshots. Hardware keyloggers are small devices placed between a keyboard and computer.

• How it spreads: phishing attachments, trojanized downloads and bundling inside other malware families.
• Real example: the CISA and Australian Cyber Security Centre advisory 2021 Top Malware Strains, published in August 2022, describes FormBook as an information stealer advertised in hacking forums that is capable of key logging and capturing browser or email client passwords, usually delivered as a phishing attachment. The same advisory notes that criminals ran mass phishing campaigns in 2021 with FormBook, Agent Tesla and Remcos.
• ATT&CK mapping: Input Capture: Keylogging (T1056.001) under Collection and Credential Access.
• Detect and prevent: phishing-resistant MFA (so a captured password alone is not enough), password managers that autofill rather than require typing, EDR detection of keyboard hooking, and physical checks of shared and public-facing machines.

9. Infostealer

An infostealer collects saved browser passwords, session cookies, autofill data, crypto wallets and files, packages them as a "log" and sends them to the attacker within minutes. Stolen session cookies are especially dangerous because they can let an attacker skip the login and MFA entirely. Infostealers are sold as subscription services, and the stolen logs are resold on criminal markets.

• How it spreads: phishing, cracked software and game cheats, malicious ads, and fake CAPTCHA pages that trick users into running commands themselves.
• Real example: the FBI and CISA released advisory AA25-141B on LummaC2 on May 21, 2025. LummaC2 first appeared for sale on Russian-language criminal forums in 2022. Actors delivered it through spearphishing and fake CAPTCHA pages that told users to open the Windows Run dialog and paste a command, which then launched an encoded PowerShell process. The advisory's indicators cover infections from November 2023 through May 2025.
• ATT&CK mapping: Credentials from Web Browsers (T1555.003) and Steal Web Session Cookie (T1539) under Credential Access; the family is Lumma Stealer (S1213).
• Detect and prevent: phishing-resistant MFA plus short session lifetimes and session revocation on risk, blocking personal browser profile sync on corporate devices, EDR alerts on processes reading browser credential stores, and monitoring for your domains in stolen credential feeds.

Our guide to infostealer malware and credential theft covers the full attack chain, and our stealer log statistics track how much stolen data circulates.

10. Remote access trojan (RAT)

A remote access trojan gives an attacker hidden, interactive control of an infected computer: browsing files, running commands, capturing the screen and webcam, logging keystrokes and downloading more tools. Legitimate remote support tools do similar things, but they show the user a visible session; a RAT hides.

• How it spreads: phishing attachments, trojanized software and loaders that install the RAT as a second stage.
• Real example: in March 2023 the FBI seized worldwiredlabs.com, the website that sold the NetWire RAT, under a warrant approved on March 3, while Croatian police arrested a suspect and Swiss police seized the hosting server, as reported by The Record. FBI analysts who tested NetWire found no visible windows or other signs on the infected computer during the connection, one of the traits that separated it from a legitimate remote access tool. CISA's 2022 malware advisory also lists Agent Tesla, NanoCore and Remcos as RATs, noting that some developers marketed them as legitimate administration tools.
• ATT&CK mapping: RAT traffic maps to Application Layer Protocol: Web Protocols (T1071.001) and Ingress Tool Transfer (T1105) under Command and Control; the family is NETWIRE (S0198). When attackers abuse legitimate remote management software instead, ATT&CK uses Remote Access Tools (T1219).
• Detect and prevent: egress filtering and proxy inspection, detection of regular "beaconing" connections, an allowlist of approved remote management tools, and EDR on every endpoint.

Malware That Hides: Rootkits, Bootkits, Fileless Malware and Logic Bombs

These types are built to avoid detection or to wait. They let attackers stay inside for months, survive reboots and cleanups, or trigger damage long after the person who planted them has left.

11. Rootkit

A rootkit modifies the operating system so that malware, files, processes and network connections are hidden from the user and from security tools. User-mode rootkits alter programs and libraries; kernel-mode rootkits load as drivers or kernel modules and can lie to almost any tool running on that system.

• How it spreads: rootkits are installed after an attacker already has administrator or root access, usually as part of a larger toolkit.
• Real example: on August 13, 2020 the NSA and FBI published an advisory on Drovorub, a Linux toolset they attributed to Russia's GRU 85th GTsSS (military unit 26165), consisting of an implant, a kernel module rootkit, a file transfer and port forwarding tool and a command and control server. As BleepingComputer summarized, the advisory called memory analysis the most effective way to find the rootkit and recommended kernel module signing and UEFI Secure Boot in Full or Thorough mode.
• ATT&CK mapping: Rootkit (T1014) under Stealth.
• Detect and prevent: enforce signed drivers and kernel modules, enable Secure Boot, collect memory images during investigations, compare what the system reports with an external view (network traffic, offline disk scans), and rebuild rather than clean a host with a confirmed kernel rootkit.

12. Bootkit

A bootkit infects the boot process, either the legacy master boot record or the UEFI boot loader, so it runs before the operating system and its security tools start. That gives it control over what loads next and lets it survive operating system reinstalls in some cases. Malware that goes one level deeper into the motherboard firmware is called a firmware or UEFI implant.

• How it spreads: bootkits are installed after compromise, using boot loader flaws or administrator access to replace boot components.
• Real example: on June 22, 2023 the NSA released a BlackLotus mitigation guide. BlackLotus is a UEFI bootkit that exploits the "Baton Drop" flaw, CVE-2022-21894, to bypass Secure Boot, because vulnerable boot loaders had not been added to the Secure Boot deny list (DBX). The guide itself notes that the install process places an older Windows boot loader in the EFI boot partition, disables Memory Integrity and BitLocker, and reboots the device.
• ATT&CK mapping: Pre-OS Boot: Bootkit (T1542.003) and, for firmware implants, System Firmware (T1542.001), under Stealth and Persistence.
• Detect and prevent: apply boot-related security updates and the optional revocation steps vendors publish, monitor the EFI boot partition for unexpected changes, use measured boot and device health attestation where available, and keep recovery media updated.

13. Fileless malware

Fileless malware avoids writing a traditional executable to disk. It runs in memory and abuses tools that are already on the system, such as PowerShell, WMI and signed Windows binaries (often called living off the land), which makes signature-based scanning far less effective.

• How it spreads: phishing links and attachments that launch scripts, malicious shortcut files, and exploits that inject code directly into memory.
• Real example: on July 8, 2019 Microsoft's research team described the Astaroth campaign, which only ran system tools throughout a complex attack chain to steal information. Microsoft's point was that fileless does not mean invisible: behavior-based detection still caught each step.
• ATT&CK mapping: Command and Scripting Interpreter: PowerShell (T1059.001), System Binary Proxy Execution (T1218) and Reflective Code Loading (T1620); the family is Astaroth (S0373).
• Detect and prevent: PowerShell script block logging, the Antimalware Scan Interface (AMSI), application control that limits script hosts, attack surface reduction rules and EDR that watches process behavior rather than files.

Our explainer on fileless malware covers the techniques and detections in more depth.

14. Logic bomb

A logic bomb is code that sits quietly inside a legitimate program or system until a condition is met, such as a date, an event or the absence of a specific user account, and then performs a harmful action like deleting data or locking users out. Logic bombs are usually planted by insiders with legitimate access, which is why they slip past perimeter defenses.

• How it spreads: it does not spread. Someone with access inserts it into code, scripts or scheduled jobs.
• Real example: on March 7, 2025 a federal jury in Cleveland convicted Davis Lu, a former software developer, of causing intentional damage to protected computers. According to the Justice Department, he planted a "kill switch" that locked out all users if his Active Directory account was disabled; it activated when he was terminated on September 9, 2019 and affected thousands of users worldwide. He was sentenced to four years in prison on August 21, 2025.
• ATT&CK mapping: ATT&CK has no logic-bomb technique. Time-based triggers often use Scheduled Task/Job (T1053), and the payload usually maps to Data Destruction (T1485) or another Impact technique.
• Detect and prevent: peer code review and separation of duties for production changes, monitoring of new scheduled jobs and scripts that reference specific accounts or dates, prompt and complete offboarding, and least privilege for developers.

See our full guide to what a logic bomb is for more cases and insider-threat controls.

Malware That Controls or Destroys at Scale: Botnets and Wipers

15. Botnet

A botnet is a network of infected computers, servers or IoT devices ("bots") controlled by an attacker through command-and-control infrastructure. The bot malware itself may be quiet, but the network can be rented out for distributed denial-of-service attacks, spam, credential stuffing, proxying criminal traffic or delivering ransomware.

• How it spreads: spam emails and loaders on computers; default or weak passwords and unpatched firmware on routers, cameras and other IoT devices.
• Real example: on August 29, 2023 the FBI and Justice Department announced the takedown of Qakbot, which spread mainly through spam emails and delivered additional malware, including ransomware. The FBI identified more than 700,000 infected computers worldwide, more than 200,000 of them in the U.S., and redirected botnet traffic to servers that told infected machines to download an uninstaller. Earlier, CISA's 2016 alert on Mirai showed the IoT version: Mirai used a list of 62 common default usernames and passwords to take over devices and powered a DDoS attack exceeding 620 Gbps against the KrebsOnSecurity blog on September 20, 2016.
• ATT&CK mapping: ATT&CK records botnets under Resource Development as Compromise Infrastructure: Botnet (T1584.005) and Acquire Infrastructure: Botnet (T1583.005); their main use maps to Network Denial of Service (T1498). The family is QakBot (S0650).
• Detect and prevent: change default credentials, segment and patch IoT devices, block outbound traffic that IoT devices do not need, and watch for command-and-control patterns in DNS and proxy logs. Our explainer on what a DDoS attack is covers the most visible botnet use. Our guide to what a botnet is covers how botnets recruit devices, how they are controlled and how to spot an infected one.

16. Wiper

Wiper malware destroys data, file systems or the disk's boot structures so that systems cannot be recovered without backups. It is used for sabotage, often by state-backed actors, and is sometimes disguised as ransomware even though no working decryption is possible.

• How it spreads: wipers are deployed after the attacker has access, frequently through domain-wide software deployment or group policy so that many machines are hit at once.
• Real example: CISA and the FBI's advisory AA22-057A describes destructive malware deployed against organizations in Ukraine in 2022. Microsoft disclosed WhisperGate on January 15, 2022, and researchers disclosed HermeticWiper on February 23, 2022; HermeticWiper manipulates the master boot record so that the device fails to boot. Our profile of Sandworm (APT44) covers NotPetya, the 2017 wiper that posed as ransomware.
• ATT&CK mapping: Data Destruction (T1485) and Disk Wipe: Disk Structure Wipe (T1561.002) under Impact; the families are WhisperGate (S0689) and HermeticWiper (S0697).
• Detect and prevent: offline, immutable backups with timed restore tests, tight control of software deployment tools and domain admin accounts, EDR alerts on raw disk writes, and a disaster recovery plan that assumes some systems cannot be cleaned.

How Malware Moves Through an Attack

Knowing the type tells you what the malware does; knowing where it sits in the attack tells you where to stop it. Most intrusions follow a similar path, described in ATT&CK tactics and in the older cyber kill chain:

After the first foothold, attackers usually need more access before they deploy ransomware or wipers. Our guides to privilege escalation and lateral movement explain those middle steps, and the MITRE ATT&CK framework guide shows how to use the matrix to plan detections.

How to Detect and Prevent Malware

No single product stops all 16 types. A short list of layered controls covers most of them, and each one can be checked rather than assumed.

Signature antivirus still has a place for well-known file-based malware, but most current threats are caught by behavior: a document that spawns PowerShell, a process reading browser password stores, an unusual outbound connection every 60 seconds, or a burst of file renames. Endpoint telemetry has to reach someone who can act on it quickly, whether an in-house SOC or a managed service.

How to Test Your Defenses Against Malware

Reading about malware types is useful; knowing which ones your controls would actually stop is better. Safe testing never uses live malware on production systems. Instead, it emulates malware behavior under written scope and rules of engagement:

• Breach and attack simulation runs safe, ATT&CK-mapped test actions continuously to check that EDR, email and network controls still alert. See our guide to breach and attack simulation.
• Purple team exercises walk through specific techniques, such as fileless execution or browser credential theft, with the defenders watching and tuning detections in real time. See what purple teaming is.
• Internal penetration tests start from an assumed foothold, the position a trojan or infostealer would give an attacker, and measure how far privilege escalation and lateral movement can go. See internal penetration testing.
• Red team engagements chain initial access, command and control and objective actions to test detection and response end to end. See what red teaming is.

The standard EICAR anti-malware test file is a harmless way to confirm that endpoint protection is active on a given machine, but it only proves that signature scanning works. Behavior-based detections need behavior-based tests.

Frequently Asked Questions

What are the main types of malware?

The main types are viruses, worms, trojans, ransomware, spyware, adware, keyloggers, rootkits, bootkits, infostealers, remote access trojans, fileless malware, botnets, wipers, cryptojackers and logic bombs. Many real malware families combine several of these, for example a trojan that installs a keylogger and joins a botnet.

What is the difference between a virus, a worm and a trojan?

A virus attaches to a host file and spreads when that file is opened or shared. A worm is standalone and spreads across networks by itself, usually by exploiting a vulnerability. A trojan does not spread on its own at all; it tricks a user into installing it by posing as legitimate software.

Which type of malware is the most dangerous for businesses?

For most organizations, ransomware and the tools that lead to it are the highest-impact types, because they combine data theft, extortion and downtime. Infostealers and loaders deserve the same attention, because stolen credentials and initial footholds are what ransomware operators buy. For current frequency data, see our malware and ransomware statistics posts.

Can antivirus detect fileless malware and rootkits?

Traditional signature antivirus struggles with both, because fileless malware leaves little on disk and kernel rootkits can hide from tools on the same system. Behavior-based EDR, script logging, Secure Boot, signed drivers and memory analysis are the main ways to detect them.

Can phones get malware?

Yes. Phones are targeted by spyware, banking trojans, adware and malicious apps. Keeping the operating system updated, installing apps only from official stores and managing corporate devices with mobile device management are the main defenses. High-risk users can enable hardened modes such as Apple's Lockdown Mode.

How do I know if my computer has malware?

Common signs include unexpected pop-ups or browser changes, slow performance or high CPU use, unknown programs or browser extensions, security tools that are disabled, and unusual network activity. Many modern threats show no visible sign, so organizations should rely on EDR alerts and log monitoring rather than user observation.

Next Step: Find Out Which Malware Would Get Through

Every malware type in this guide depends on something that can be tested: a phishing email that reaches an inbox, an unpatched service, a user with too much access, a missing alert, or a backup that has never been restored. Fix the obvious gaps first, then check the result from an attacker's point of view.

DeepStrike's penetration testing services include manual network, web application and cloud penetration testing, social engineering assessments and red team engagements, with reports that give reproduction steps, root causes and remediation guidance for every validated finding. To scope a test that starts from an assumed malware foothold, contact the team.

About The Author

Mohammed Khalil is a Cybersecurity Architect at DeepStrike, specializing in advanced penetration testing and offensive security operations. With certifications including CISSP, OSCP, and OSWE, he has led numerous red team engagements, focusing on cloud security, application vulnerabilities, and adversary emulation. His work involves dissecting complex attack chains and developing resilient defense strategies for clients in the finance, healthcare, and technology sectors.

Sources and References

• NIST CSRC Glossary: Malware
• MITRE ATT&CK
• MITRE ATT&CK: Software
• FBI: Melissa Virus
• CISA: Indicators Associated With WannaCry Ransomware (TA17-132A)
• NVD: CVE-2017-0144
• CISA: Emotet Malware (AA20-280A)
• CISA, FBI and HHS: #StopRansomware: ALPHV Blackcat (AA23-353A)
• FTC: Lenovo Settles FTC Charges It Harmed Consumers With Preinstalled Software
• CISA and FBI: Iranian Government-Sponsored APT Actors Compromise Federal Network, Deploy Crypto Miner (AA22-320A)
• NVD: CVE-2021-44228 (Log4Shell)
• Citizen Lab: FORCEDENTRY, NSO Group iMessage Zero-Click Exploit Captured in the Wild
• NVD: CVE-2021-30860
• U.S. Department of Commerce: Commerce Adds NSO Group and Other Foreign Companies to Entity List
• CISA and ACSC: 2021 Top Malware Strains (AA22-216A)
• FBI and CISA: Threat Actors Deploy LummaC2 Malware (AA25-141B)
• The Record: Website selling long-abused Netwire RAT malware seized by FBI
• NSA: NSA and FBI Expose Russian Previously Undisclosed Malware Drovorub
• BleepingComputer: NSA discloses new Russian-made Drovorub malware targeting Linux
• NSA: NSA Releases Guide to Mitigate BlackLotus Threat
• NSA: BlackLotus Mitigation Guide (PDF)
• NVD: CVE-2022-21894
• Microsoft Security Blog: Dismantling a fileless campaign (Astaroth)
• U.S. Department of Justice: Texas Man Convicted of Sabotaging His Employer's Computer Systems and Deleting Data
• U.S. Department of Justice: Chinese National Who Deployed "Kill Switch" Code on Employer's Network Sentenced to Four Years in Prison
• FBI: FBI, Partners Dismantle Qakbot Infrastructure in Multinational Cyber Takedown
• CISA: Heightened DDoS Threat Posed by Mirai and Other Botnets
• CISA and FBI: Destructive Malware Targeting Organizations in Ukraine (AA22-057A)
• MITRE ATT&CK technique pages: T1080, T1091, T1204.002, T1210, T1036, T1486, T1490, T1176.001, T1557, T1496, T1429, T1430, T1113, T1123, T1056.001, T1555.003, T1539, T1071.001, T1105, T1219, T1014, T1542.003, T1542.001, T1059.001, T1218, T1620, T1053, T1485, T1584.005, T1583.005, T1498, T1561.002 (linked in each section)
• MITRE ATT&CK software pages: S0366 WannaCry, S0367 Emotet, S1068 BlackCat, S0289 Pegasus for iOS, S1213 Lumma Stealer, S0198 NETWIRE, S0373 Astaroth, S0650 QakBot, S0689 WhisperGate, S0697 HermeticWiper (linked in each section)