Overview
Malware — short for malicious software — is any program written to harm, exploit, or gain unauthorized access to systems and data. This lesson maps the major categories so you can recognize and reason about them. Understanding the categories is defensive knowledge; this course studies malware to defend against it, never to build or deploy it.
Learning objectives
- Define malware and its main categories.
- Distinguish categories by how they spread and what they do.
- Recognize that categories often overlap in real samples.
Core concept
Common malware categories:
- Virus — attaches to a file or program and spreads when that host is run; needs user action to propagate.
- Worm — self-propagating; spreads across networks on its own, without user action.
- Trojan — disguised as legitimate software; relies on tricking the user into running it.
- Ransomware — encrypts or locks data and demands payment (an availability attack).
- Spyware — secretly gathers information (keystrokes, browsing, credentials).
- Adware — forces unwanted advertising; sometimes bundles spyware.
- Rootkit — hides deep in the system to conceal its presence and maintain access.
- Botnet client (bot) — turns a device into a remotely controlled node in an attacker's network.
How it works
These categories describe behavior and propagation, not rigid boxes. Modern malware is usually blended: a trojan may drop a rootkit that installs ransomware and enrolls the host in a botnet. Classifying a sample still helps — it tells you how it likely spread and what it probably did, guiding both response and prevention.
Practical example
A user downloads a "free video converter" that works as advertised (a trojan disguise) but silently installs a keylogger (spyware) to steal banking credentials and a bot agent that joins a botnet. One download, several categories — which is exactly why layered defenses matter.
Cybersecurity relevance
Malware analysis and defense are core to the SOC & Blue Team path. Recognizing categories helps you interpret alerts ("this looks like ransomware behavior") and choose the right containment. The MITRE ATT&CK framework catalogs the techniques these malware families use.
Common mistakes
- Treating "virus" as a synonym for all malware. A virus is one category with a specific propagation method.
- Assuming a sample fits exactly one category — blended threats are the norm.
Key takeaways
- Malware is any software built to harm or gain unauthorized access.
- Major categories include viruses, worms, trojans, ransomware, spyware, rootkits, and bots.
- Categories describe behavior and spread; real malware often blends several.
Check your understanding
- What is the key difference in how a virus and a worm spread?
- Why is "it's just a virus" often an inaccurate description of a modern infection?