Malware is short for "malicious software". In everyday language, people often speak of viruses, but the virus is actually only one of many types. Malware is relevant for companies because it plays a role in almost every attack chain: as a tool for reconnaissance, as a beachhead in the network, or as the actual damaging function.
How does malware work?
Malware usually reaches a system through email attachments, manipulated downloads, infected storage media, or exploited security vulnerabilities. There it carries out its function, tries to establish persistence so that it survives a restart, and often contacts a command-and-control server of the attackers. Different types can be distinguished by their function:
- Viruses attach themselves to other files and spread when those files are executed.
- Worms spread independently across networks, often through security vulnerabilities.
- Trojans disguise themselves as useful programs and open access in the background.
- Spyware and infostealers collect credentials, browser sessions, and other information.
- Ransomware encrypts data and extorts a ransom.
- Loaders download additional malware as soon as they have reached a system.
Many malicious programs combine several of these functions. Attackers increasingly also use tools that are already present in the operating system, such as scripting environments or administration programs. This approach is known as "living off the land" and is difficult to detect for purely signature-based antivirus scanners.
Typical examples
- An Office document from a phishing email downloads additional malware from the internet after it is opened.
- An infostealer on a privately used device captures saved passwords that someone later uses to sign in to the company account.
- Free software from an unofficial source contains a hidden trojan.
- A USB stick someone found is plugged into a workstation.
What companies should keep in mind
- Use up-to-date protection on all endpoints and servers, in a business environment ideally with behavioral analysis as in endpoint detection and response.
- Update operating systems and applications regularly.
- Install software only from approved sources and restrict local administrator rights, see least privilege.
- Block macros in files from the internet by policy.
- Do not just remove findings; clarify how the malware got into the system.