Malware

• 1. Introduction

  ›

  Malware - a portmanteau of "malicious software" - is any program deliberately built to disrupt, destroy, or steal. By 2017, Symantec's Internet Security Threat Report counted 669,947,865 distinct malware variants in existence. That figure was twice the total from the year before. Cybercrime, with malware attacks at its center, was projected to cost the global economy six trillion US dollars in 2021, growing at a rate of 15 percent each year.

  What begins with a floppy disk slipped into a drive can end with a hospital locked out of its own patient records. A device no more suspicious than a USB-connected desk fan can carry the infection. How did a theoretical curiosity dreamed up by mathematicians become one of the most costly threats in human history? What shapes does it take, how does it hide, and what can actually stop it?

• 2. Origins of a Theory

  ›

  John von Neumann was the first to argue, on purely theoretical grounds, that a computer program could reproduce itself. His work established a plausibility result in computability theory long before the personal computer existed. Fred Cohen then moved the idea from theory into practice, experimenting with actual computer viruses and confirming von Neumann's postulate. Cohen's 1987 doctoral dissertation was devoted entirely to the subject.

  Cohen also investigated early properties like detectability and self-obfuscation using rudimentary encryption. From the mid-1990s onward, researchers began combining cryptographic technology with malicious payloads, an approach that laid the groundwork for both ransomware and modern evasion techniques.

  Before the internet reached ordinary households, viruses traveled on floppy disks, inserting copies of themselves into executable programs or boot sectors. The first IBM PC virus documented in the wild was a boot sector virus called (c)Brain. The Farooq Alvi brothers created it in Pakistan in 1986. Early computer viruses had already targeted the Apple II and Mac, but (c)Brain's appearance on the IBM PC signaled a much wider battlefield.

• 3. From Pranks to Profit

  ›

  The Morris worm of 1988 was the first well-known network-borne infectious program. It spread across SunOS and VAX BSD systems not by inserting itself into other programs, but by exploiting security holes in network server software and running as its own separate process. Like many early pieces of infectious code, it was written as an experiment rather than an act of sabotage.

  Since 2003, the majority of widespread viruses and worms have been designed to take control of machines for illicit purposes. Infected computers, sometimes called "zombie computers," have been used to send email spam, host illegal content, and launch distributed denial-of-service attacks as a form of extortion.

  By 2012, it was estimated that roughly 60 to 70 percent of all active malware relied on some form of click fraud, generating payments from advertisers by simulating user clicks. Around 22 percent of all advertising clicks at that time were fraudulent. In 2024, a botnet owner was arrested for running a pay-per-install scheme, illustrating how malware has become a structured commercial enterprise with its own business model.

• 4. Weapons and Sabotage

  ›

  Stuxnet is the most cited example of malware deployed as a political weapon. It was engineered specifically to interfere with industrial control systems, and it can travel across an air-gapped network via a USB drive without ever needing to exfiltrate data. Its existence confirmed that malware could be used to physically damage infrastructure, not just steal data.

  The attack on Sony Pictures Entertainment in November 2014 used malware known as Shamoon, also called W32.Disttrack, to delete files on a massive scale and damage master boot records. A similar strike hit Saudi Aramco in August 2012, actions described by researchers as acts of "computer killing."

  Since 2021, malware has been increasingly aimed at systems running critical infrastructure such as electricity distribution networks. Microsoft's Digital Crimes Unit reported in May 2025 that a program called Lumma Stealer had become the favored information-stealing tool among hundreds of cyber threat actors, capable of emptying bank accounts, holding schools for ransom, and disrupting critical services.

• 5. A Taxonomy of Threats

  ›

  Ransomware splits into two broad types: locker ransomware, which freezes access to a computer without touching its files, and crypto ransomware, which encrypts the contents and demands payment before releasing them. Programs such as CryptoLocker and WannaCry belong to the crypto category, typically demanding payment in Bitcoin.

  On Android, Jisut and SLocker are among the most prevalent forms of lock-screen ransomware, with Jisut accounting for nearly 60 percent of all Android ransomware detections. A separate category called Trojan horses disguises itself as ordinary software; in spring 2017, Mac users encountered a new version of the Proton Remote Access Trojan, which was designed to extract password data from browser autofill systems, the macOS keychain, and password vaults.

  Rootkits solve a different problem for attackers: concealment. They modify the host operating system so that malware becomes invisible in process lists and inaccessible to file readers. An early illustration of this persistence appears in the Jargon File, describing two programs on a Xerox CP-V time-sharing system that would detect when the other had been terminated and relaunch it within milliseconds. The only reliable way to stop them was to kill both simultaneously.

• 6. The Art of Hiding

  ›

  An estimated 33 percent of malware is not detected by antivirus software. The most common evasion technique involves encrypting the malicious payload so that scanners cannot match it to a known signature. A tool called a crypter packages an encrypted blob of harmful code alongside a decryption stub. Because antivirus programs typically scan files on disk rather than contents held in memory, the stub can decrypt and load the payload into memory undetected.

  Polymorphic malware takes evasion further by transforming itself into new variations, generating signatures that do not match previous versions. Fileless malware goes further still, operating entirely within memory and exploiting legitimate system tools rather than installing its own files. Researchers call this approach Living off the Land, or LotL. In 2017, LotL attacks increased by 432 percent; by 2018 they accounted for 35 percent of all attacks.

  Timing-based evasion adds another layer, with malware choosing to run only during vulnerable windows, such as the system boot process, and staying dormant the rest of the time. The 2018 Data Breach Investigations Report by Verizon found that email remains the dominant delivery channel, responsible for 96 percent of malware delivery worldwide.

• 7. Defenses and Their Limits

  ›

  Antivirus software works through two core methods: static analysis, which studies program code and builds a signature, and dynamic or heuristic analysis, which watches how a program behaves at runtime and blocks unexpected activity. Microsoft Security Essentials covered Windows XP, Vista, and Windows 7, while Windows Defender extended that coverage to Windows 8, 10, and 11.

  Sandboxing confines applications to a controlled environment, restricting their access to system resources and isolating them from other processes. Browser sandboxing specifically isolates web browser tabs from the operating system, trapping potentially harmful code before it can exploit vulnerabilities. Escaping a sandbox is possible, but it requires targeting flaws in the sandbox mechanism itself or in the operating system's sandboxing features.

  Network homogeneity is a systemic risk that defenses often overlook. It was estimated that approximately 83 percent of malware infections between January and March 2020 spread through systems running Windows 10. When every machine on a network runs the same operating system, a single exploited vulnerability can propagate across all of them. Segmenting networks into isolated subnetworks with firewalls between them reduces this exposure, and tools like Secunia PSI, available free for personal use, can scan machines for outdated software listed in public databases such as the National Vulnerability Database.