Overview
How does malware actually get onto a system? Understanding infection concepts — the vectors and techniques malware uses to arrive and take hold — lets defenders close the doors attackers rely on.
Learning objectives
- Identify common infection vectors.
- Explain how malware gains initial execution and persistence.
- Connect infection vectors to preventive controls.
Core concept
An infection vector is the path malware takes to reach and run on a target. The most common:
- Phishing / malicious email — attachments or links that deliver malware; the single most common entry point.
- Malicious downloads — trojanized software, fake updates, pirated files.
- Drive-by downloads — compromised or malicious websites that exploit a browser or plugin.
- Removable media — infected USB drives (the "USB drop" tactic).
- Software vulnerabilities — exploiting unpatched services, which is how worms self-spread.
- Supply chain — malware hidden in a legitimate vendor's software update.
How it works
Infection typically has stages: delivery (the vector), execution (getting code to run, often by tricking the user or exploiting a flaw), and persistence (surviving reboots via scheduled tasks, startup entries, or system services). Attackers then establish command and control (C2) to operate the malware remotely. Breaking any stage — blocking delivery, preventing execution, detecting persistence — disrupts the infection.
Practical example
An employee receives an email that looks like an invoice with a document attachment (delivery via phishing). Opening it and enabling macros runs a script (execution) that downloads malware, which adds itself to system startup (persistence) and connects out to an attacker's server (C2). Security-awareness training, blocking macros, and outbound filtering each break a different stage.
Cybersecurity relevance
Mapping infection vectors directly informs prevention: email filtering and training counter phishing; patching counters vulnerability-based spread; disabling macros and controlling USB use close common execution paths. This is the practical link between "how malware arrives" and "what control stops it."
Common mistakes
- Focusing only on the malware file and ignoring the vector that delivered it.
- Cleaning the malware but leaving the persistence mechanism, allowing reinfection.
- Underestimating phishing, which starts a large share of infections.
Key takeaways
- Infection vectors include phishing, malicious downloads, drive-bys, removable media, vulnerabilities, and supply chain.
- Infection proceeds through delivery, execution, persistence, and command and control.
- Each stage maps to a preventive control that can break the chain.
Check your understanding
- Name three infection vectors and one control that reduces each.
- Why does removing malware without removing its persistence mechanism often fail?