Malware.

What Does Malware Do?

Malware runs on a device the owner did not mean to infect. What it does next depends on what the attacker wants. Some malware steals passwords and browser data; infostealers are the usual example. Some locks files for ransom. Some gives the attacker a remote door into the network, which is later used to move around and copy data.

Most malware tries to stay hidden. It may disguise itself as a normal program, hide inside another process or delay its work until nobody is watching.

What Are the Main Types of Malware?

• Virus and worm: a virus attaches itself to a file and spreads when that file is opened. A worm spreads on its own. Shai-Hulud, for example, is a self-replicating npm worm that steals developer tokens; see the Shai-Hulud profile.
• Trojan and backdoor: harmful code that pretends to be a useful program or opens a hidden way in. HOOKEDGE is a Windows backdoor that Recorded Future links with moderate confidence to BlueDelta (APT28) and Symantec to Swallowtail (APT28); it hides its traffic in webhook.site and the Edge browser. See the HOOKEDGE profile, trojan and remote access trojan.
• Ransomware: locks or steals data and demands payment. See ransomware.
• Infostealer: collects saved logins, cookies and other data from a device. See infostealer.
• Loader: a small program whose job is to download and start other malware. See malware loader.
• Wiper: destroys data on purpose and offers no way to get it back. See wiper malware.

One attack often uses several of these in turn. A loader arrives first, then an infostealer, then ransomware.

How Does Malware Get In?

The common routes are ordinary ones. A phishing email carries an attachment or a link. A ClickFix page talks the user into pasting and running a command; the ROMULUS delivery platform that Forescout described uses this trick (see the ROMULUS profile). A fake software download or a malicious advert sends the user to an infected installer. A server with a known, unpatched flaw lets an attacker run code directly. A poisoned open-source package can pull malware into a build.

Malware that arrives through a stolen login needs no exploit at all. The attacker signs in as a normal user and installs what they want.

Why Does Malware Matter?

A single infected laptop can expose saved passwords, session cookies and files. Those stolen logins are often sold or reused later, so the damage can appear weeks after the infection. Many infostealers are themselves rented out as malware-as-a-service. For a company, the cost shows up as downtime, data loss, incident response work and, in some cases, legal duties to report a breach.

How Do You Defend Against Malware?

• Patch internet-facing systems first, starting with flaws on the CISA Known Exploited Vulnerabilities catalog.
• Filter email attachments and links, and train staff to report odd messages.
• Run endpoint detection and response (EDR) on laptops and servers.
• Give users only the access they need, so one infection reaches less.
• Keep offline or immutable backups and test the restore.
• Watch for company logins that appear in stolen data, then reset them quickly.

The Brandefense malware library describes individual malware families, how they behave and how to defend against them.