Malware: worms, trojans, ransomware, etc.

4.2 Summarize various types of attacks and their impact

Malware is short for malicious software. It’s any software intentionally designed to harm a computer, network, or user. Malware can:

Malware can spread in many ways, including email attachments, infected software downloads, network vulnerabilities, or removable media.

Definition: A virus is a piece of code that attaches itself to files or programs. It spreads when the infected file is opened or executed.
Behavior in IT systems:
- Can corrupt files or system data
- Might cause programs or servers to crash
- Can slow down network or system performance
Example: A virus attaches to an internal company document. When employees open it, their computers get infected, and the virus spreads to shared network drives.

Definition: Worms are self-replicating malware that spread automatically across networks without user action.
Behavior in IT systems:
- Exploit vulnerabilities in operating systems or network services
- Can flood network traffic, causing slowdowns or outages
- Can deliver other malware payloads (like ransomware)
Example: A worm exploits a network printer vulnerability and automatically copies itself to every connected computer in the office.

Definition: Trojans appear to be legitimate software but contain hidden malicious functions. Unlike viruses and worms, they don’t self-replicate.
Behavior in IT systems:
- Can create a backdoor for attackers to remotely access the system
- Can steal credentials, install keyloggers, or download additional malware
Example: An employee downloads a software update from an unverified source. It installs normally but secretly gives hackers remote access to the workstation.

Definition: Malware that encrypts a victim’s files or systems and demands payment for decryption.
Behavior in IT systems:
- Encrypts critical files, making them inaccessible
- Often spreads through phishing emails or infected downloads
- Can halt operations until the ransom is paid
Example: A ransomware attack encrypts all files on a company file server. Employees can’t access shared documents until the attack is mitigated or a backup is restored.

Definition: Malware that secretly monitors user activity and sends the information to an attacker.
Behavior in IT systems:
- Can log keystrokes to capture usernames and passwords
- Can monitor network traffic or browser activity
- Can operate silently, making it hard to detect
Example: Spyware installed on office computers records login credentials for cloud services.

Definition: Software that automatically displays unwanted advertisements. Some adware may also collect user information.
Behavior in IT systems:
- Generates pop-ups, redirecting users to malicious sites
- Can consume network bandwidth and slow down systems
Example: Adware installed on a workstation triggers pop-ups when employees browse the internet, distracting them and slowing performance.

Definition: Malware designed to gain unauthorized administrative access while hiding its presence.
Behavior in IT systems:
- Allows attackers to control systems without detection
- Can disable security software or hide other malware
Example: A rootkit installed on a server hides itself and other malware while giving hackers full access to sensitive databases.

Definition: Malware that records every keystroke made on a device.
Behavior in IT systems:
- Captures sensitive information like passwords, credit card numbers, or confidential documents
- Often installed as part of a Trojan
Example: A keylogger captures credentials of the IT admin, allowing attackers to access secure network resources.

Definition: Networks of infected devices controlled by an attacker (bots). They can be used for large-scale attacks.
Behavior in IT systems:
- Launch Distributed Denial of Service (DDoS) attacks
- Send spam emails or malware
- Operate silently on multiple systems
Example: Hundreds of office computers infected with bot malware are remotely controlled to overwhelm a target website with traffic.

Know the difference between viruses (attach to files), worms (self-replicate), Trojans (disguise as legitimate software).
Understand ransomware encrypts files, spyware steals data, rootkits hide themselves, keyloggers track keystrokes, botnets control multiple devices.
Recognize malware delivery methods and impacts on IT systems.