Malware Categories — Recognize common malware categories (virus, worm, trojan, ransomware) (conceptual) - Cyber Security

SECTION 1

Historical Context & Motivation

The history of malware — short for malicious software — stretches back to the earliest networked and personal computing environments, long before cybersecurity existed as a formal discipline. Understanding the historical trajectory of malware is essential because each new category emerged in response to specific technological affordances and defensive gaps; the taxonomy we use today reflects decades of adversarial evolution between attackers and defenders. Early experiments in self-replicating code were largely academic curiosities, but as computing proliferated, threat actors quickly recognized the potential for financial gain, espionage, and disruption, driving the diversification of malware into the categories we study in modern threat analysis.

1971 • Creeper — The First Self-Replicating Program

Bob Thomas created Creeper on ARPANET as an experimental self-replicating program. It moved between DEC PDP-10 mainframes, displaying the message "I'm the creeper, catch me if you can!" Ray Tomlinson later wrote Reaper to delete it — arguably the first antivirus.

1986 • Brain — The First PC Virus in the Wild

Two Pakistani brothers, Basit and Amjad Alvi, created Brain, which infected the boot sector of IBM PC floppy disks. It was designed as a copy-protection mechanism but spread globally, demonstrating how viruses leverage physical media for propagation.

1988 • Morris Worm — The Internet's Wake-Up Call

Robert Tappan Morris released the Morris Worm, which exploited Unix sendmail, fingerd, and rsh/rexec vulnerabilities to propagate autonomously. It infected roughly 6,000 machines — about 10% of the Internet — and led to the creation of CERT/CC.

2000 • ILOVEYOU — Social Engineering at Scale

The ILOVEYOU trojan, disguised as a love letter email attachment, demonstrated the devastating effectiveness of social engineering. It overwrote files and emailed itself to all Outlook contacts, causing an estimated $10 billion in damages and illustrating the trojan paradigm of deceptive packaging.

2017 • WannaCry — Ransomware Goes Global

WannaCry combined worm-like propagation (via the EternalBlue SMB exploit) with ransomware payload encryption, hitting over 200,000 systems across 150 countries. It paralyzed the UK's National Health Service and demonstrated that ransomware had become a critical threat to critical infrastructure.

This timeline reveals a clear pattern: as computing environments evolved from isolated mainframes to globally networked personal devices and cloud infrastructure, malware categories diversified to exploit each new attack surface. The central question that this lesson addresses is deceptively simple yet foundational — how do we classify malicious software into meaningful categories, and what distinguishes one category from another in terms of propagation mechanism, payload, and required user interaction? A rigorous understanding of these distinctions is prerequisite to threat modeling, incident response, and defensive architecture.

SECTION 2

Core Principles & Definitions

Before examining individual malware categories, it is important to establish the axes along which malware is classified. The taxonomy is not arbitrary — it reflects fundamental differences in propagation mechanism, dependency on host programs, required user interaction, and payload intent. These four dimensions form the conceptual basis for distinguishing viruses from worms, trojans from legitimate software, and ransomware from other payload types. In practice, modern malware often blends characteristics — WannaCry, for instance, combined worm propagation with a ransomware payload — but understanding the canonical categories provides the vocabulary and mental models necessary for precise threat communication.

Virus

A virus is a piece of malicious code that attaches itself to a legitimate host program or file and replicates when the host is executed. It requires human action (e.g., opening a file, running a program) to propagate. Like its biological namesake, it cannot reproduce independently.

Worm

A worm is a self-contained, self-replicating program that propagates autonomously across networks by exploiting vulnerabilities — no host file and no user interaction required. Worms can spread exponentially, consuming bandwidth and system resources.

Trojan

A trojan (or Trojan horse) masquerades as legitimate or desirable software to trick users into executing it. Unlike viruses and worms, trojans do not self-replicate; they rely entirely on social engineering to spread. Once executed, they deliver a hidden malicious payload.

Ransomware

A ransomware is malware whose payload encrypts victim data or locks system access and demands payment (typically in cryptocurrency) for the decryption key. Ransomware is classified by its payload rather than propagation — it may arrive via trojan download, phishing, or worm-like exploitation.

✦

KEY TAKEAWAY

Think of malware classification like classifying vehicles. A virus is like a parasite that hitches a ride in another car's trunk — it needs that car to move. A worm is a self-driving car that navigates roads (networks) autonomously. A trojan is a delivery van labeled 'Free Pizza' that actually contains a surveillance team. Ransomware describes what happens after arrival: the team locks your house and demands payment for the key. Notice that ransomware describes the payload, while the other three describe delivery and replication mechanics — a critical conceptual distinction.

SECTION 3

Visual Taxonomy of Malware Categories

The following diagram provides a visual taxonomy that maps each malware category along the two most important classification axes: self-replication capability (whether the malware can copy itself) and requirement for user interaction (whether a human must take an action for the malware to activate or spread). By placing each category on this two-dimensional grid, we can immediately see their structural relationships and understand why certain defenses are effective against some categories but not others.

The quadrant diagram positions each malware category according to its self-replication capability (vertical axis) and its dependence on user interaction (horizontal axis). Worms occupy the upper-left (high replication, no user needed), viruses the upper-right (high replication, user-triggered), trojans the lower-right (no replication, user-triggered), and ransomware spans the lower region with dashed lines indicating it can be delivered via any vector.

Notice that the diagram reveals a key insight: ransomware is orthogonal to the other three categories because it is defined by its payload (encryption and extortion) rather than its propagation mechanism. A ransomware attack could arrive as a trojan (delivered via a phishing email), propagate as a worm (exploiting network vulnerabilities), or even be embedded within a virus (attached to infected executables). This means ransomware is best understood as a payload classification that can compose with any delivery classification — a distinction that is critical for both threat modeling and incident response.

SECTION 4

Propagation Mechanisms & Lifecycle

Each malware category follows a distinct lifecycle from initial infection to payload execution, and understanding these mechanisms at a systems level is what separates rigorous analysis from surface-level recognition. Although this lesson is conceptual rather than mathematical, we can formalize the propagation dynamics of self-replicating malware using epidemiological models borrowed from mathematical biology, which provides useful intuition about containment strategies.

Virus Lifecycle

A virus lifecycle consists of four phases. In the dormant phase, the virus lies idle within its host file, waiting for a trigger condition (a specific date, an event, or simply the next execution of the host). During the propagation phase, the virus copies itself into other programs or files on the system, often hooking into executable headers (PE injection on Windows) or macro containers (document viruses). The triggering phase occurs when a logical condition is met, transitioning the virus from dormancy to active execution. Finally, during the execution phase, the virus delivers its payload — which can range from benign screen messages to destructive file deletion or data exfiltration.

Worm Propagation Model

Worm propagation can be modeled using a variant of the SIR (Susceptible–Infected–Removed) epidemiological model. In this framework, each networked host exists in one of three states: susceptible (vulnerable but not yet infected), infected (actively spreading the worm), or removed (patched or quarantined). The rate of infection depends on the scanning rate of the worm, the density of vulnerable hosts, and the infection probability per contact — parameters that directly parallel the basic reproduction number R₀ in epidemiology.

WORM INFECTION RATE (SIMPLIFIED SIR)

dI/dt = β × S × I − γ × I

Where I = number of infected hosts, S = number of susceptible hosts, β = contact/infection rate (determined by the worm's scanning algorithm and exploit reliability), and γ = removal rate (determined by how quickly administrators patch or isolate infected machines). A worm spreads when β × S > γ, analogous to R₀ > 1 in epidemiology.

Trojan Delivery Mechanisms

Trojans do not self-replicate, so their "propagation" is entirely mediated by social engineering and deception. Common delivery vectors include phishing emails with malicious attachments, drive-by downloads from compromised websites, bundling with pirated software, and fake software updates. Once executed, trojans typically establish command-and-control (C2) communication with an attacker's server, enabling remote access, credential theft, keylogging, or serving as a dropper that downloads additional malware components. The absence of self-replication means that each new infection requires a fresh social engineering interaction, which is why trojans are heavily correlated with phishing campaign volume.

Ransomware Encryption Pipeline

Modern ransomware typically employs a hybrid encryption scheme. Upon execution, the ransomware generates a unique symmetric key (often AES-256) for bulk file encryption, then encrypts that symmetric key with the attacker's embedded RSA or ECC public key. This means only the attacker's corresponding private key can decrypt the symmetric key, which in turn is needed to decrypt the victim's files. The victim sees a ransom note demanding cryptocurrency payment in exchange for the private key or a decryption tool. Advanced ransomware families like Ryuk and Conti also perform double extortion — exfiltrating data before encrypting it, so even if the victim restores from backups, the attacker can threaten to publish the stolen data.

RANSOMWARE HYBRID ENCRYPTION

C_file = AES-256(K_sym, plaintext) | C_key = RSA(PK_attacker, K_sym)

The file ciphertext C_file is produced by encrypting plaintext with a random symmetric key K_sym. The encrypted key C_key is stored alongside the ciphertext. Only the attacker's private key can recover K_sym, making brute-force recovery computationally infeasible.

SECTION 5

Detailed Classification & Sub-Types

Each of the four canonical malware categories contains significant internal diversity. Viruses, for example, are further classified by their infection target (boot sector, file infector, macro, polymorphic, metamorphic), while worms are distinguished by their exploitation strategy and scanning algorithm. The following diagram provides a hierarchical view of these sub-types, illustrating how the high-level taxonomy branches into more specific threat classifications used in real-world threat intelligence reporting.

The hierarchy diagram shows how the four canonical malware categories branch into sub-types. Viruses subdivide by infection target (boot sector, file infector, macro) and evasion strategy (polymorphic, metamorphic). Worms subdivide by propagation channel. Trojans subdivide by post-compromise function, and ransomware subdivides by extortion strategy. The bottom section lists evasion techniques that are shared across all categories.

Sub-Type	Category	Key Characteristic	Example
Polymorphic Virus	Virus	Mutates its byte-level signature on each replication while preserving functionality, evading signature-based detection	Storm Worm (also worm-like), Virlock
Metamorphic Virus	Virus	Completely rewrites its own code (instruction substitution, register reassignment) — no decryption routine to detect	Zmist, Regswap
Network Worm	Worm	Exploits network service vulnerabilities (e.g., SMB, RPC) to propagate without email or user interaction	Conficker, Slammer
RAT (Remote Access Trojan)	Trojan	Provides full remote control to the attacker via C2 infrastructure, including screen capture, keylogging, and file transfer	DarkComet, njRAT, Poison Ivy
Double Extortion Ransomware	Ransomware	Exfiltrates sensitive data before encryption; threatens public disclosure even if the victim restores from backups	Maze, REvil, Conti, LockBit

Selected sub-types across malware categories

SECTION 6

Worked Example: Classifying a Real-World Threat

Consider the following scenario based on a real-world incident report: an organization's security operations center (SOC) observes anomalous activity. Your task is to classify the malware using the taxonomy framework developed in this lesson. The scenario describes the WannaCry attack of May 2017, and we will systematically apply our classification criteria.

Classifying WannaCry Using the Four-Axis Framework

1
Step 1 — Gather Observable Indicators

The SOC observes the following: (a) machines on the internal network are becoming infected without any user clicking links or opening attachments; (b) network traffic analysis reveals scanning activity on TCP port 445 (SMB); (c) infected machines display a ransom note demanding $300 in Bitcoin; (d) files on infected machines have been encrypted with the extension .WNCRY; (e) the malware appears to be exploiting the MS17-010 (EternalBlue) vulnerability in Windows SMBv1.

Five key indicators collected: autonomous propagation, SMB scanning, ransom demand, file encryption, and known CVE exploitation.
2
Step 2 — Evaluate Propagation Mechanism

The malware spreads autonomously across the network by exploiting a vulnerability (EternalBlue) — no user interaction is required for propagation. It does not attach itself to a host file; instead, it operates as a standalone executable. This autonomous, self-replicating, network-exploiting behavior aligns with the worm classification on the propagation axis.

Propagation classification: Worm — self-replicating, no host dependency, no user interaction required.
3
Step 3 — Evaluate Host Dependency

WannaCry does not inject itself into existing executables or documents. It is a standalone binary that executes independently. This confirms it is not a virus (which requires a host) and not a trojan (which disguises itself as legitimate software). The initial infection vector for the first machine in each network may have involved a phishing email (trojan-like delivery), but the dominant propagation mechanism is worm behavior.

Host dependency: None — standalone executable, consistent with worm classification.
4
Step 4 — Evaluate Payload Intent

The payload encrypts user files with AES-128 and RSA-2048 hybrid encryption and demands cryptocurrency payment for decryption. This is the defining characteristic of ransomware. The presence of a ransom demand, a Bitcoin wallet address, a countdown timer, and file encryption constitute unambiguous ransomware indicators.

Payload classification: Ransomware — hybrid encryption, ransom demand, cryptocurrency payment.
5
Step 5 — Synthesize Final Classification

WannaCry is best classified as a ransomware worm — a compound category that combines worm-class propagation (autonomous exploitation of MS17-010 via SMBv1 across networks) with a ransomware payload (AES+RSA file encryption and Bitcoin extortion). This compound classification reflects the lesson's key insight: propagation mechanism and payload intent are orthogonal classification axes, and real-world malware often occupies more than one category simultaneously.

Final: Ransomware Worm — worm propagation + ransomware payload. MITRE ATT&CK mapping: Lateral Movement (T1210 – Exploitation of Remote Services) + Impact (T1486 – Data Encrypted for Impact).

SECTION 7

Comparative Analysis: Strengths & Limitations of Each Category

From an attacker's perspective, each malware category has distinct operational strengths and limitations that influence selection during campaign planning. From a defender's perspective, understanding these trade-offs informs the choice of detection and mitigation strategies. The following comparison examines each category across critical operational dimensions — note that "strength" here is used from the threat actor's viewpoint to understand adversarial reasoning, a core component of threat modeling.

Dimension	Virus	Worm	Trojan	Ransomware
Propagation Speed	Slow — depends on human file sharing and execution frequency	Very fast — exponential spread limited only by network bandwidth and vulnerability density	Slow — each infection requires new social engineering	Variable — depends on delivery vector (trojan = slow, worm = fast)
Stealth / Evasion	Moderate — polymorphic/metamorphic variants evade signatures effectively	Low — network scanning creates detectable traffic anomalies	High — blends with legitimate software, minimal network footprint initially	Low post-execution — encryption activity is conspicuous; high pre-execution if delivered stealthily
Persistence	High — embedded in host files that are backed up and shared	Low — exists in memory or as standalone process; removed by reboot unless persistence mechanism added	High — installs persistence mechanisms (registry keys, scheduled tasks, services)	Low need — payload is one-shot (encrypt and demand); persistence is unnecessary after encryption
Monetization	Low — traditionally focused on disruption or vandalism; indirect monetization via botnets	Moderate — creates botnets for DDoS-for-hire or spam	High — enables data theft, banking fraud, credential harvesting, espionage	Very high — direct revenue through ransom payments; Ransomware-as-a-Service (RaaS) ecosystem
Primary Defense	Signature-based AV, application allowlisting, code signing	Patch management, network segmentation, IDS/IPS, firewalls	User awareness training, email filtering, application vetting, EDR behavioral analysis	Offline backups (3-2-1 rule), endpoint detection, network segmentation, incident response planning

Comparative analysis of malware categories across operational dimensions

✦

KEY TAKEAWAY

No single defense strategy is effective against all malware categories. The defense-in-depth principle is directly motivated by the diversity of malware propagation mechanisms: signature-based antivirus catches known viruses but not zero-day worms; network segmentation contains worms but does not prevent trojans that arrive via email; user training reduces trojan infections but cannot stop automated worm exploitation. Effective security architecture is essentially the dual of the malware taxonomy — each defensive layer targets a specific category's propagation or payload mechanism.

SECTION 8

Connection to Advanced Threat Analysis

The four canonical malware categories presented in this lesson form the foundation for more sophisticated threat classification frameworks used in professional cybersecurity. As you progress into advanced coursework and practice, you will encounter several frameworks that build directly on these concepts, adding dimensions of sophistication, attribution, and tactical context that extend far beyond simple categorical classification.

This Lesson's Concepts	Advanced Framework	What It Adds
Malware categories (virus, worm, trojan, ransomware)	MITRE ATT&CK Framework	Maps malware behaviors to specific Tactics, Techniques, and Procedures (TTPs) in a standardized matrix; enables adversary emulation and detection engineering
Propagation mechanism classification	Cyber Kill Chain (Lockheed Martin)	Structures the attack lifecycle into seven phases (reconnaissance through actions on objectives); propagation maps to delivery, exploitation, and lateral movement phases
Payload classification (ransomware)	Diamond Model of Intrusion Analysis	Adds adversary, infrastructure, and victim vertices to capability (payload); enables attribution and campaign linking across incidents
Binary classification (malware vs. benign)	Machine Learning Malware Detection	Uses static features (opcode sequences, import tables) and dynamic features (API call traces, system call graphs) to classify malware families automatically at scale
Evasion techniques (polymorphism, metamorphism)	Advanced Persistent Threats (APTs)	Nation-state actors combine multiple malware categories with custom zero-day exploits, living-off-the-land techniques, and supply-chain compromises in sustained campaigns

Mapping foundational concepts to advanced threat analysis frameworks

A particularly important evolution to note is the emergence of Ransomware-as-a-Service (RaaS), which has fundamentally altered the threat landscape since approximately 2019. In the RaaS model, ransomware developers create and maintain the encryption payload and C2 infrastructure, then license their tools to affiliates who handle the actual intrusion and deployment. This division of labor means that a single ransomware strain may be delivered via dozens of different vectors by different affiliates, further decoupling the payload classification from the propagation mechanism. Groups like LockBit, ALPHV/BlackCat, and Cl0p operate as criminal enterprises with customer support portals, negotiation teams, and revenue-sharing agreements — a sophistication level that underscores why foundational malware taxonomy is just the starting point for modern threat analysis.

ℹ

Looking Ahead

In subsequent lessons on threat modeling and incident response, you will apply these malware categories within structured frameworks like STRIDE (for threat modeling) and NIST SP 800-61 (for incident handling). The classification skills developed here — identifying propagation mechanism, host dependency, user interaction requirement, and payload intent — translate directly into the indicators of compromise (IOCs) and behavioral signatures used in security operations.

SECTION 9

Practice Problems

Question 1: CONCEPTUAL

A security analyst argues that ransomware should not be considered a separate malware category because it is 'just a payload type.' Another analyst insists it deserves its own category because it has unique defensive implications. Evaluate both positions and explain why the distinction between propagation-based classification and payload-based classification matters for incident response.

Show answer

Both analysts raise valid points that illuminate a fundamental tension in malware taxonomy. The first analyst is technically correct that ransomware is defined by its payload (data encryption plus extortion) rather than its propagation mechanism — the same ransomware strain can arrive as a trojan (phishing attachment), propagate as a worm (network exploit), or be manually deployed by an attacker who gained access through other means. This makes it orthogonal to the virus/worm/trojan trichotomy, which is defined by replication and delivery mechanics. However, the second analyst's position has strong practical justification: ransomware's unique combination of time-critical data loss, cryptocurrency payment demands, and double-extortion tactics creates distinct incident response requirements (backup restoration, negotiation decisions, regulatory reporting obligations) that differ fundamentally from responding to a RAT or a banking trojan. In practice, the cybersecurity community treats ransomware as a functional category precisely because the defensive playbook it demands is unique. This highlights that useful classification systems are purpose-driven — taxonomies optimized for malware analysis (propagation-based) may differ from those optimized for incident response (payload-based), and security professionals must be fluent in both.

Question 2: BASIC CALCULATION

Consider a simplified SIR model for worm propagation where β (infection rate) = 0.0001, the initial number of susceptible hosts S₀ = 10,000, and the initial number of infected hosts I₀ = 1. Assuming the removal rate γ = 0.05 (5% of infected machines are patched per time unit), calculate the initial rate of change dI/dt at t = 0 using the equation dI/dt = β × S × I − γ × I. Will the infection grow or shrink at the outset, and what does this tell us about the critical threshold for containment?

Show answer

Substituting the given values into the SIR equation: dI/dt = (0.0001 × 10,000 × 1) − (0.05 × 1) = 1.0 − 0.05 = 0.95 infected hosts per time unit. Since dI/dt > 0, the infection is growing at t = 0. The infection will grow whenever β × S > γ, which means S > γ/β = 0.05/0.0001 = 500 susceptible hosts. This is the critical threshold: if the number of susceptible (unpatched) hosts drops below 500, the worm's spread will decelerate and eventually die out. This directly informs the containment strategy: aggressive patching and network segmentation that reduces the effective susceptible population below this threshold will halt propagation. In practice, this is why patch management velocity is the single most important defense against network worms — it reduces S below the critical value.

Question 3: INTERMEDIATE

You are analyzing a piece of malware with the following characteristics: (1) it arrived as an email attachment claiming to be an invoice PDF; (2) upon execution, it did not replicate to other files on the system; (3) it established an encrypted C2 channel to an external server; (4) through the C2 channel, it downloaded a second-stage payload that encrypted all user documents; (5) a ransom note appeared demanding Monero payment. Classify each stage of this malware's behavior using the four-category framework, and explain why a single-category classification is insufficient.

Show answer

This scenario describes a multi-stage attack that cannot be captured by a single malware category. Stage 1 (delivery): The initial executable arriving as a deceptive email attachment is classified as a trojan — it masquerades as a legitimate invoice to trick the user into execution, and it does not self-replicate. Stage 2 (C2 establishment): The trojan functions specifically as a dropper or RAT sub-type, establishing command-and-control communication to stage additional payloads. Stage 3 (second-stage payload): The downloaded encryption component is ransomware, specifically a crypto-ransomware variant that encrypts files and demands Monero (chosen over Bitcoin for its stronger privacy features). The full classification would be: trojan dropper delivering crypto-ransomware. This compound classification is necessary because the defensive response must address both components — email filtering and user training target the trojan delivery vector, while offline backups and endpoint detection target the ransomware payload. A single-category classification would miss critical aspects of the attack chain and lead to incomplete mitigation.

Question 4: APPLIED

You are the security architect for a mid-size hospital network with 2,000 endpoints. Given the threat of a WannaCry-style ransomware worm, design a layered defense strategy that specifically addresses each classification axis (propagation mechanism, host dependency, user interaction, payload intent). For each defensive layer, explain which malware characteristic it mitigates and identify any residual risk that layer does not address.

Show answer

A defense-in-depth strategy targeting each axis would include the following layers. Against the worm propagation mechanism: (1) aggressive patch management to eliminate the EternalBlue vulnerability (reduces S in the SIR model below critical threshold), (2) network segmentation with VLANs and internal firewalls to limit the worm's scanning reach (reduces effective β), and (3) IDS/IPS rules detecting SMB exploit patterns (detects and blocks propagation attempts). Residual risk: zero-day exploits for which no patch exists. Against user interaction (for the initial infection vector): (4) email gateway filtering with attachment sandboxing to catch trojan-delivered initial payloads, and (5) security awareness training focused on phishing recognition. Residual risk: sophisticated spear-phishing that bypasses filters and trained users. Against the ransomware payload: (6) endpoint detection and response (EDR) with behavioral rules that detect rapid file enumeration and encryption patterns (canary files can trigger alerts), (7) immutable offline backups following the 3-2-1 rule (3 copies, 2 media types, 1 offsite), and (8) least-privilege access controls to limit the blast radius. Residual risk: double extortion where data is exfiltrated before encryption, rendering backups insufficient for preventing data disclosure. Against host dependency (general hardening): (9) application allowlisting to prevent unauthorized executables from running, and (10) disabling unnecessary services (especially SMBv1 in this scenario). This layered approach ensures that no single point of failure compromises the entire defense.

Question 5: CRITICAL THINKING

Modern fileless malware operates entirely in memory, uses legitimate system tools (PowerShell, WMI, .NET reflection) for execution, leaves no traditional file artifacts on disk, and may propagate laterally via credential theft rather than vulnerability exploitation. Critically evaluate whether the traditional four-category taxonomy (virus, worm, trojan, ransomware) is adequate for classifying fileless threats. Propose either (a) a modification to the existing taxonomy that accommodates fileless malware, or (b) an argument for why the existing categories remain sufficient despite the fileless paradigm shift. Support your position with specific technical reasoning.

Show answer

The traditional taxonomy remains conceptually sufficient but requires interpretation refinement rather than structural overhaul. Fileless malware challenges the taxonomy primarily on the host dependency axis: a fileless virus equivalent (e.g., a VBA macro that executes entirely via PowerShell reflection without dropping an executable) still parasitically depends on a host (the document), so the virus classification holds with an expanded definition of 'host' that includes document macros and scripting engines. Fileless worm behavior (e.g., lateral movement via WMI remoting using stolen credentials) satisfies the worm criteria of autonomous, self-directed propagation without user interaction, even though the mechanism is credential-based rather than exploit-based — expanding 'vulnerability exploitation' to include 'trust exploitation' preserves the classification. Fileless trojans (e.g., a malicious PowerShell script disguised as a system administration tool) still rely on social engineering and deception. However, a valid argument for taxonomy modification would note that the traditional categories implicitly assume file-based artifacts that enable detection (signature scanning of executables), and fileless malware fundamentally breaks this assumption. A useful modification would add an orthogonal axis for execution substrate — file-based versus memory-only versus living-off-the-land — creating a 3D classification space (propagation × payload × substrate) that better captures the detection challenges posed by fileless threats. This extended taxonomy would inform defensive strategy by highlighting that traditional AV (file scanning) is insufficient and that behavioral analysis, memory forensics, and script-block logging become essential for the fileless substrate class.

SUMMARY

Lesson Summary

Summary

This lesson established a rigorous, multi-axis taxonomy for classifying malicious software. The four canonical categories are distinguished by two primary axes: viruses parasitically attach to host files and replicate when the host is executed by a user; worms are self-contained programs that propagate autonomously across networks by exploiting vulnerabilities, requiring no user interaction; trojans masquerade as legitimate software and rely on social engineering to trick users into executing them, with no self-replication; and ransomware is defined by its payload — encrypting data and demanding payment — rather than its delivery mechanism, making it orthogonal to the other three categories.

Key insights include the orthogonality of propagation and payload classification (real-world malware like WannaCry combines worm propagation with ransomware payload), the applicability of epidemiological models (SIR) to worm propagation analysis, and the direct mapping between malware categories and defense-in-depth strategies — each defensive layer targets a specific category's propagation or payload mechanism. These foundational concepts connect directly to advanced frameworks including MITRE ATT&CK, the Cyber Kill Chain, and the emerging challenges posed by fileless malware and Ransomware-as-a-Service (RaaS) ecosystems.