# Malware Threats

> Chapter 7 of the Courseiva EC-CEH curriculum — https://courseiva.com/learn/ec-ceh/malware-threats

**Official objective:** 4.2 — Analyze different types of malware, including viruses, worms, trojans, ransomware, and their propagation methods.

## Introduction

How do you stop a crime you cannot see? Malware threats are the invisible enemies every ethical hacker must understand to defend a network. For the 312-50 exam, you need to know exactly how viruses, worms, trojans, and ransomware operate, how they spread, and how to spot them before they strike.

## The Soured Dinner Party Analogy

A dinner party is a carefully planned event. The host (the computer user) invites guests over (downloads software), prepares food (runs the system), and expects a pleasant evening.

Now imagine a guest arrives who isn't really a friend. This guest is a virus. They don't just eat the food; they secretly rewrite the recipe cards in the host's kitchen (modify system files), and then leave copies of those altered cards hidden around the house to infect tomorrow's party. The damage spreads because the host trusted them.

A worm is different. A worm is a guest who, once inside, starts calling every person in the host's phone book, inviting themselves to every other dinner party in the city. They replicate without needing anyone to open the door for them.

A trojan is a guest who shows up carrying a beautiful bottle of wine (a free game or utility). The host opens it, and the bottle releases smoke that knocks everyone out, allowing the guest to steal the silverware (sensitive data).

A ransomware guest doesn't steal the silverware. Instead, they lock the pantry door and demand the host pay for a key. If the host refuses, the guest dumps the food in the bin (data deletion) and leaves the kitchen in chaos.

Each type of malcontent guest uses a different method to ruin the party, but the result is always a disaster for the host.

## Core explanation

Malware is short for 'malicious software'. It is any program or code designed to damage, disrupt, or gain unauthorised access to a computer system. Think of it as digital vandalism or digital theft. For the CEH exam, you must recognise four major types: viruses, worms, trojans, and ransomware.

A virus is a piece of code that attaches itself to a legitimate program or file. It cannot run on its own; it needs a host, like a human carrier. When you run the infected program, the virus executes and then replicates itself by attaching to other programs on your computer. A classic example is the Melissa virus, which spread by infecting Word documents and then emailing copies of itself to the first 50 contacts in the victim's address book. Viruses spread because of user action — opening an infected attachment or running a compromised installer.

A worm is different. A worm does not need a host program. It is a standalone program that replicates itself across a network by exploiting vulnerabilities in operating systems or software. The famous Morris worm of 1988 used a weakness in Unix email software to spread across the early internet. Worms consume bandwidth and system resources because they constantly scan for new machines to infect. They are often used to drop payloads — the damaging part of the malware — onto victim computers.

A trojan is named after the Trojan Horse of Greek myth. It disguises itself as something desirable — a free game, a software crack, an important-looking attachment — but inside it contains malicious code. Unlike a virus or worm, a trojan does not replicate itself. It relies entirely on tricking the user into installing it. Once inside, it can steal passwords, log keystrokes, or open a backdoor for a remote attacker. A famous example is the Zeus trojan, which stole banking credentials from millions of computers.

Ransomware is a type of malware that encrypts the victim's files using strong encryption. Encryption is a way of scrambling data so that only someone with the right key (a long password-like string) can unscramble it. The attacker then demands a ransom, usually in cryptocurrency like Bitcoin, in exchange for the decryption key. Ransomware spreads through phishing emails, malicious downloads, and even by exploiting vulnerabilities in public-facing servers. The WannaCry attack in 2017 used a worm-like component to spread rapidly across organisations that had not applied a security update.

Propagation methods are the ways malware spreads. The most common methods are:

- Email attachments: Malware hides in a file attached to a convincing email.
- Malicious downloads: Tricking users into downloading a fake update or tool.
- Removable media: USB drives or external hard disks carrying infected files.
- Network shares: Worms copy themselves to shared folders on a local network.
- Drive-by downloads: Visiting a compromised website that automatically downloads malware without the user clicking anything.
- Exploit kits: Automated tools that scan a visitor's browser for unpatched vulnerabilities and then push malware.

Understanding these types and methods is critical for the exam. You will be asked to identify a malware type from a description of its behaviour, and to know which propagation method fits a given scenario.

## Real-world context

Imagine you are a junior security analyst at a medium-sized company called BrightPath Logistics. One Monday morning, the IT helpdesk receives dozens of calls: employees cannot open their spreadsheets or documents. Instead, they see a pop-up window demanding a payment of 2 Bitcoin to unlock their files. You have a ransomware outbreak on your hands.

Step one is containment. You immediately instruct the network team to disconnect the affected computers from the network. This can be done by unplugging the Ethernet cable or disabling the Wi-Fi adaptor. You also disable the company's Wi-Fi network temporarily to prevent the ransomware from spreading to laptops that are still offline. Containment buys you time to analyse the situation.

Step two is assessment. You identify which systems are encrypted. You check the event logs on the first infected machine to see how the ransomware entered. The logs show that the user opened an email attachment named 'Invoice_January.xlsm' from an unknown sender. This is a classic phishing attack. The file likely contained a macro — a small script that runs inside Excel — which downloaded the ransomware from a remote server. You note this propagation method for your report.

Step three is eradication. You have a backup of the file server from Friday night. You restore the encrypted files from that backup. This is why regular backups are critical: they are the only reliable defence against paying a ransom. You also run an antivirus scan across the entire network to find and remove any remnants of the malware. The scan finds two other computers with the same malicious file, which you delete immediately.

Step four is remediation. You patch the vulnerability. In this case, the ransomware exploited an old version of Microsoft Office that allowed macros to run without warning. You force-update all Office installations and change the security settings to block macros from running unless digitally signed by a trusted publisher. You also implement email filtering rules that block executable file types and warn users when an email comes from outside the organisation.

Step five is communication. You write a brief report for management. It includes:
- The type of malware: ransomware (specifically, a variant of LockBit).
- The propagation method: phishing email with malicious macro.
- The number of affected systems: 12 workstations and one file server.
- The data loss: none, because backups were available.
- The cost: estimated 15 hours of IT staff time and one day of lost productivity.

You then present this report at the weekly security meeting. The CEO asks what you would do differently. You recommend a user awareness training programme so employees learn to recognise suspicious emails before clicking. This is the human layer of defence.

In a real IT environment, you would also use tools like network monitoring (to detect unusual traffic patterns from worm activity) and endpoint detection and response (EDR) software that can automatically isolate infected machines. The key is to move fast, because ransomware spreads in minutes.

## Exam focus

The 312-50 exam tests your ability to distinguish between malware types and identify propagation methods. Expect at least 7 to 10 questions on this topic across the whole exam. The questions are often scenario-based, giving you a short description of an attack and asking you to choose the correct malware type or method.

The exam loves to test these specific concepts:

- The definition of each malware type and its key characteristic. For example, the fact that a virus needs a host file, while a worm does not.
- The difference between a trojan and a backdoor. A trojan is the delivery mechanism; a backdoor is the hidden access it creates.
- Propagation methods: know the difference between a worm exploiting a network vulnerability and a virus spreading via infected email attachments.
- How ransomware works: encryption of files, demand for payment, and the fact that paying the ransom is not recommended.
- The role of social engineering in trojan and ransomware attacks.

Common traps the exam sets:

- They describe a worm but use the word 'virus' in the scenario. Read carefully: if the malware replicates without user action, it is a worm, not a virus.
- They describe a trojan but the answer choices include 'rootkit'. A rootkit hides the malware's presence; a trojan is the program that delivers it.
- They give a scenario where the malware encrypts files and demands payment. The correct answer is ransomware, not any other type.
- They describe a virus that attaches to a legitimate program. The wrong answer might say 'worm' because the description includes 'self-replicating'. A virus does self-replicate, but only by attaching to other programs.

Key definitions to memorise:
- Malware: any software designed to cause damage or unauthorised access.
- Virus: attaches to a host, requires user action to spread.
- Worm: standalone, self-replicates across a network.
- Trojan: disguises itself as legitimate, does not replicate.
- Ransomware: encrypts files for ransom.
- Payload: the damaging action performed by malware.
- Propagation: the method by which malware spreads.

There are also questions about 'logic bombs' (malware that triggers on a specific condition, like a date) and 'rootkits' (software that hides malware by modifying the operating system). These are less common but still appear. For rootkits, the exam focuses on how they gain and hide privileged access.

Finally, you must remember that antivirus software detects known malware by signatures (unique patterns of code), but new malware (zero-day exploits) can evade signature detection. This is why heuristic analysis (looking for behaviour, like attempting to encrypt many files) is important.

## Step by step

1. **Delivery** — The malware arrives on the target system. This can happen via a phishing email, a malicious download, a compromised website (drive-by download), or an infected USB stick. The attacker chooses the method that is most likely to succeed against the victim.
2. **Execution** — The victim runs the malware. For a trojan, this means clicking the fake installer. For a virus, it means opening an infected file. For a worm, execution can happen automatically when the worm exploits a vulnerability and gains code execution on the system.
3. **Infection** — The malware establishes itself on the system. A virus will attach to other programs. A trojan may install a backdoor. Ransomware will start encrypting files. The malware may also modify system settings to ensure it runs every time the computer starts.
4. **Propagation** — The malware spreads to other systems. A worm scans the network for vulnerable machines and copies itself. A virus waits for the user to share an infected file. Ransomware may also spread through network shares or by exploiting vulnerabilities in other services.
5. **Payload Activation** — The malware performs its intended destructive action. For ransomware, this is the file encryption. For a trojan, it might be stealing passwords or logging keystrokes. For a worm, it might be dropping additional malware or consuming network bandwidth.

## Comparisons

### Virus vs Worm

**Virus:**
- Requires a host program to attach to.
- Spreads only when a user runs the infected host.
- Relies on user action (e.g., opening an email attachment).

**Worm:**
- Does not need a host; it is a standalone program.
- Spreads automatically across a network without user intervention.
- Exploits network vulnerabilities or misconfigurations.

### Trojan vs Ransomware

**Trojan:**
- Disguises itself as legitimate software to trick users.
- Does not self-replicate; relies on social engineering.
- Often creates a backdoor for remote control.

**Ransomware:**
- Also often uses disguise, but its purpose is encryption.
- Does not self-replicate (unless combined with a worm).
- Primary purpose is to encrypt files and demand a ransom.

### Ransomware vs Scareware

**Ransomware:**
- Encrypts files, making them inaccessible.
- Demands a specific ransom in cryptocurrency.
- Causes permanent data loss if ransom is not paid.

**Scareware:**
- Shows fake warnings claiming malware is found.
- Asks for payment to fix a non-existent problem.
- Does not actually encrypt files; it is a scam.

### Worm vs Trojan

**Worm:**
- Self-replicates automatically over a network.
- Does not require user interaction to spread.
- Often consumes network bandwidth due to replication.

**Trojan:**
- Does not self-replicate at all.
- Requires user action (clicking) to install.
- Primarily used for stealthy access or data theft.

## Diagram

_A flowchart showing the four main types of malware covered in the CEH exam: virus, worm, trojan, and ransomware, along with their key characteristics._

```mermaid
flowchart TD
    A[Malware Types] --> B[Virus]
    A --> C[Worm]
    A --> D[Trojan]
    A --> E[Ransomware]
    B --> F[Requires host file]
    C --> G[Self-replicates over network]
    D --> H[Disguised as legitimate software]
    E --> I[Encrypts files for ransom]
    F --> J[Spreads via user action]
    G --> K[Spreads automatically]
```

## Common misconceptions

- **Misconception:** A virus and a worm are the same thing because both are self-replicating. **Reality:** A virus requires a host program and user action to spread, while a worm is standalone and spreads automatically across a network. (The media often uses 'virus' as a catch-all term for any malware, which blurs the distinction. The exam is strict about the difference.)
- **Misconception:** A trojan is a type of virus. **Reality:** A trojan is not a virus. It does not replicate at all. It is a separate category that relies on deception to be installed. (People assume all malware is a virus because that is the most familiar term. The trojan's lack of self-replication is its defining feature.)
- **Misconception:** Ransomware only affects individual users, not large organisations. **Reality:** Ransomware frequently targets businesses, hospitals, and government agencies because they have more critical data and are more likely to pay. (High-profile attacks like WannaCry and Colonial Pipeline show that enterprise networks are prime targets. Beginners may think of ransomware as a personal-computer problem.)
- **Misconception:** You cannot get malware unless you click on a link or download something. **Reality:** Drive-by downloads and worm propagation can infect a system without any user interaction, simply by visiting a compromised website or being on the same network. (This misconception comes from thinking only user error causes infections. Exploit kits and worms prove otherwise.)
- **Misconception:** Antivirus software stops all malware instantly. **Reality:** Antivirus uses signature detection and heuristics, but zero-day malware (unknown threats) can bypass it until a signature is created. Multiple layers of defence are needed. (Beginners believe antivirus is a silver bullet. In reality, it is one tool in a broader security strategy.)

## Key takeaways

- A virus requires a host file and user action to spread; a worm is standalone and spreads automatically over a network.
- A trojan disguises itself as legitimate software to trick users into installing it; it does not replicate on its own.
- Ransomware encrypts the victim's files and demands payment for the decryption key; paying the ransom is not recommended.
- Propagation methods include email attachments, malicious downloads, removable media, network shares, drive-by downloads, and exploit kits.
- Social engineering is often used to deliver trojans and ransomware by exploiting human trust.
- The payload of malware is the destructive or unauthorised action it performs, such as data theft, file encryption, or system damage.

## FAQ

**What is the difference between a virus and a worm for the CEH exam?**

A virus needs a host program and user action to spread, while a worm is a standalone program that spreads automatically across a network without user interaction.

**Can a trojan be removed by an antivirus?**

Yes, if the antivirus has a signature for that trojan. But some trojans are designed to evade detection by using encryption or by hiding as legitimate system processes.

**Does ransomware only target Windows computers?**

No. While ransomware commonly targets Windows due to its large user base, variants also exist for macOS, Linux, and even mobile platforms like Android.

**How do drive-by downloads work without clicking?**

When you visit a compromised website, it runs a script that checks your browser for unpatched vulnerabilities. If it finds one, it silently downloads and executes malware without any visible prompt.

**What is a backdoor in the context of trojans?**

A backdoor is a hidden method of accessing a system without normal authentication. A trojan often installs a backdoor so the attacker can remotely control the infected computer.

**Should you pay the ransom if infected by ransomware?**

No. There is no guarantee the attacker will provide the decryption key, and paying encourages more attacks. It is better to rely on backups and restore the data from them.

## Check your understanding

1. **Which type of malware is standalone and can replicate itself across a network without any user interaction?**

   Answer: A worm. It does not need a host file and spreads automatically by exploiting vulnerabilities.

2. **What is the primary difference between a trojan and a virus?**

   Answer: A trojan does not replicate itself; it relies on disguise to trick users into installing it. A virus replicates by attaching to a host program.

3. **How does ransomware typically propagate in a corporate environment?**

   Answer: Ransomware often arrives via a phishing email with a malicious attachment, then spreads through network shares or by exploiting vulnerabilities in other systems.

4. **In a scenario where a user visits a website and malware is silently downloaded without any click, what propagation method is being used?**

   Answer: This is a drive-by download. The website uses an exploit kit to find a vulnerability in the visitor's browser and pushes malware automatically.

5. **What is a payload in the context of malware?**

   Answer: A payload is the damaging or unauthorised action performed by malware, such as encrypting files (ransomware) or installing a backdoor (trojan).

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/ec-ceh/malware-threats