Ruslan Rakhmetov, Security Vision
A year ago, when we described the types of cyberattacks, we told you about the different types of malicious software (Mware), paid attention to viruses, worms and ransomware. In this article, we'll give you more examples and explain how the world of malware works, how it spreads, and how it can harm you.
In general terms, Malware is created to harm a computer, network or user, but it is developed like other programs and sometimes behaves like something useful. All types of our current objects of study can be united by the notion of Malware( Malware, as an abbreviation for Malicious Software). All types of Malware differ in their methods of spreading, penetration, appearance and the tasks that attackers set for them.
1. Viruses are the programmes that gave their name to the information protection tool (IPS) known to many people, antivirus, which we described in our reviews earlier. Viruses are transmitted through files, emails, media (e.g. USB sticks) and even through vulnerabilities in systems. The main feature of a virus is that it requires user action to spread (e.g., opening a file or running a programme).
Viruses attach themselves to other files or programmes and are activated when the user interacts with the infected object. They can corrupt data, slow down the computer, display unwanted messages, or even cause a complete system shutdown.
The virus infiltrates a file or programme, modifying its code, disguises itself so that the user does not notice the changes and activates after interacting with the infected file. The virus can then delete data, change system settings, run other malicious programmes or execute specific commands, and gets its name from the way it spreads: it creates copies of itself and spreads them, infecting new files or devices.
It can be compared to the flu virus, which infects others through contact (just as a file infects a system through interaction), an ink stain, which, like spilled ink, is hard to clean up and can ruin neighbouring pages. Gardeners are closer to the description of a weed seed: the virus is ‘planted’ in one file, but gradually infects the whole ‘garden’.
To protect yourself, you should use an antivirus, do not open suspicious files and regularly update your software.
2. Worms (Worms) are stand-alone programmes that spread over the network without the need to infect other files. They exploit vulnerabilities in operating systems or network protocols to copy themselves to new devices. Worms often do not require user interaction: they actively seek out targets on the local network or over the Internet.
A worm exploits a vulnerability (such as an unopened port or an old version of software) to infiltrate, then creates a copy of itself on the victim's system and scans the network to find new devices to infect. It can download other malware, cause network congestion or data corruption, and once infected, the worm acts on its own without user control. It can be compared to a swarm of locusts that devours everything in its path, or a stream of water that erodes a wall and finds and expands gaps in the defence.
3. Trojans (or simply Trojans, Trojans) masquerade as useful or harmless software. Their name comes from the myth of the Trojan Horse, which was taken inside a city under the guise of a gift.
The user thinks they are installing a useful programme (such as a game or an update). Once launched, the Trojan activates in stealth mode and performs malicious actions, it can open the ‘door’ to the system for other attacks, collect data or inject viruses. The trojan can slow down the system or disable antivirus to go undetected and then perform its actions, such as stealing passwords, mining cryptocurrency, or spying on the user.
The first comparison comes from a legend: a trojan looks safe, but there is danger lurking inside. Like a candy with poison under a beautiful package, or a gift that looks valuable but is actually harmful, or a fake note that looks real but definitely causes problems when used.
3.1 Banking Trojans are a type of Trojan that specifically target users' financial information: banking logins and passwords, card numbers, PINs, etc. They are spread via phishing emails. They spread via phishing emails, downloaders or infected websites and monitor visits to banking sites or data entry. The attacker uses the stolen data to withdraw money or transfer funds to themselves.
Compare such a trojan to a suspicious person at an ATM who peeks at your PIN while standing behind you, a fraudster posing as a bank employee, a hidden camera or a fake cheque used by a scammer.
4. Backdoors -Backdoors are programmes or special code that gives an attacker hidden access to a device. Sometimes backdoors are intentionally left by software developers to access the system for diagnostic purposes. However, they are often used by hackers to bypass security systems.
A backdoor can be embedded in a legitimate application or introduced through a vulnerability. Attackers use backdoors to remotely control a device. The system can operate as normal, but the hacker is able to control processes and collect data, as well as disable security mechanisms to introduce other malware.
A backdoor can be compared to a back door in a house, an unlocked back door that can be used by a burglar, a duplicate key or a door without alarm: a backdoor works like a secret tunnel leading to a fortress that only enemies know about, so it can only be found by scanning the source code of applications, such as SAST or DAST.
5. Droppers are programmes that are designed to deliver other types of malware to the victim's device. The downloader itself is not necessarily harmful, but its purpose is to ‘bring’ a virus, trojan, or spyware to the device. The downloader is distributed as part of a regular application or email attachment, then connects to the attacker's server and downloads the desired malicious file. The virus or trojan installed in this way begins to take effect.
It is like a deliveryman who brings a ‘parcel’ with unpleasant contents, a container with ‘extra’ cargo. The downloader itself works like a matryoshka doll: the first shell opens and launches the hidden threat.
6. Keyloggers are programs that record keystrokes on a keyboard to obtain passwords, logins or other sensitive information. They are installed as part of other software or through a vulnerability, record everything that is typed on the keyboard, and send this data to the attacker. Analogy:
- Peeping Neighbour: Like a neighbour who watches your activities through a window.
- Camera above the keyboard: Records everything you type.
- Diary spy: Like a notebook in which someone writes down your information.
- Phone bug: Like a listening device to collect data.
- Hidden camera in a shop: Records the actions of customers for dishonest purposes.
7. Malicious Macros -Malicious Macros do not act like the programmes described above. They are scripts embedded in documents (e.g. Word or Excel) that can automate tasks to perform attacks. They are distributed through documents (the VPO comes in the form of a file with macros included), after opening which it executes code (e.g. downloading a virus). The macro itself may be harmless, but it can be used to download a virus, trojan, or other member of the VPO family.
Macros can be compared to an instruction manual that deceives the reader (e.g. ‘useful tips’ that lead to breakage) or to a fish bait with a hook - it looks interesting and you want to eat it, but in fact it is a trap.
8. Rookits are programmes that hide the presence of malicious code on a device. On their own, they are sometimes unable to cause harm, but due to their properties, they help other types of RPOs to stay on the system without being detected.
They enter the device through vulnerabilities or Trojans, modify system processes and files so that they are undetectable, and allow the attacker to remain hidden. They can be compared to a chameleon that becomes invisible or nearly invisible, or a master of disguise that helps others effectively hide in the ‘jungle’ of the infected device.
Protecting yourself from rootkits can be done by using rootkit detection software and working on an account without administrator privileges.
Describing the different types of malware, we have described how they are organised and how they spread and get on users' devices. To conclude our review, we'll share fifteen expert tips on how to protect yourself from all malware and protect your data:
1. Install up-to-date antivirus software and regularly update its databases;
2. Make sure your operating system and installed programmes have up-to-date security updates.
3. Use official app shops (Google Play, App Store) and manufacturers' websites, download files only from trusted sources.
4. Check URLs before clicking on them: scammers can use fake sites with Trojans and hijackers.
5. Do not open attachments from unknown senders and be careful with file formats such as *.exe, *.zip, *.docm: they may contain trojans, downloaders and macros.
6. Use different devices or isolated accounts for work and play.
Working online:
1. Use secure connections, work only over secure networks (HTTPS, VPN) and avoid public Wi-Fi without encryption.
2. Usesandboxes (Sandbox) or virtual machines to test suspicious programmes before installing them.
3. Do not use outdated versions of browsers and its plugins.
4. Install ad blockers to avoid being exposed to sites with malicious banners.
5. If not required, disable macro execution in Word, Excel and other office applications.
For corporate environments:
1. Implement layered defences, use firewalls, intrusion detection systems (IDS/IPS) and network segmentation.
2. Apply the principle of least privilege for users and systems, limit access rights using Zero Trust methodology.
3. Conduct regular cybersecurity and social engineering training, using, for example, Kaspersky, Phishman or Deteact technologies.
4. use two-factor authentication (2FA/MFA) to improve account security.
5. Back up critical data regularly and store it in isolated systems.
6. Use encryption to store and transmit sensitive information.
7. Use traffic analysis tools to identify suspicious connections.
8. Regularly analyse event logs (log files) to identify suspicious activity.
Following these recommendations significantly reduces the likelihood of a VPO infection. Even simple measures such as regular system updates and caution when opening files can prevent many threats.
