🚧 Under construction — VoTechWorks is being built. A free tech program — complimentary, as our commitment to get America working.
voTechWorksGrade 13 · a vocational technology learning center, by urbanicity
newSchoolWorks.com › VoTechWorks › Technology & Design › Cybersecurity › Cybersecurity Threats: Attack Types, Threat Actors, and Vulnerability Analysis › Lesson 3
TEC-CYBE44-02 · Lesson 3 · 15 clock hours · theory

Malware Types: Viruses, Worms, Trojans, Ransomware, Spyware, and Rootkits

Objective. Students will distinguish among six categories of malware by mechanism of infection, persistence method, and payload behavior, and match each to a real-world example.

⚠ Pending professional review

This lesson, its worked examples and its practice questions has not yet been verified by an industry-certified professional or by a certification or approval body. It is a study draft and may contain errors. Do not use it as instructions for work on a job site or on live equipment. Always follow your instructor, your supervising professional, and current official references and regulations.

VoTechWorks program approval and accreditation are still in progress. Credentials are issued only by the certifying bodies named in each program, after their own exams.

What Is Malware?

Malware — short for malicious software — is any program or code designed to damage, disrupt, or gain unauthorized access to a computer system. Security professionals categorize malware by how it spreads, how it stays on a system, and what harm it causes. Understanding these three dimensions helps you identify a threat quickly and choose the right response.

Viruses

A virus attaches itself to a legitimate file or program. When a user executes that host file, the virus code runs and copies itself into other files on the same system or on connected drives. Viruses require human action to spread — someone must open the infected file. They persist by embedding in executable files, boot sectors, or documents that support macros. Their payloads range from displaying annoying messages to corrupting or deleting data.

Historical example: The Melissa virus (1999) spread through infected Microsoft Word documents sent as email attachments. When opened, it emailed itself to the first 50 contacts in the victim's Outlook address book, overwhelming mail servers.

Worms

A worm is self-replicating malware that spreads across networks without any user interaction. It exploits vulnerabilities in network services or operating systems to copy itself from machine to machine. Because it needs no host file and no human trigger, a worm can propagate extremely fast. Persistence is achieved by writing copies of itself to disk or injecting into running processes.

Historical example: The WannaCry ransomware worm (2017) used the EternalBlue exploit targeting the SMBv1 protocol in Windows to spread automatically across networks, infecting hundreds of thousands of systems in over 150 countries within days.

Trojans

A Trojan (Trojan horse) disguises itself as legitimate software to trick users into installing it. Unlike viruses and worms, Trojans do not self-replicate. Once installed, they open a backdoor for attackers, steal credentials, download additional malware, or give remote control of the system. They persist through registry run keys, scheduled tasks, or startup folders.

Historical example: The Zeus Trojan (first observed around 2007) was distributed through phishing emails and drive-by downloads. It logged keystrokes and stole online banking credentials from millions of users.

Ransomware

Ransomware encrypts a victim's files or locks their device and demands payment — typically in cryptocurrency — in exchange for the decryption key. Modern ransomware often combines a Trojan delivery mechanism with worm-like lateral movement. It persists long enough to encrypt as many files as possible before displaying a ransom note. Even if a ransom is paid, recovery is not guaranteed.

Historical example: The Colonial Pipeline attack (2021) involved DarkSide ransomware, which forced a major US fuel pipeline operator to shut down operations for several days, causing fuel shortages across the southeastern United States.

Spyware

Spyware secretly monitors user activity and sends collected data to a remote attacker or advertiser. It may record keystrokes, capture screenshots, log browsing history, or harvest passwords and financial information. Spyware is designed to stay hidden; it persists using registry entries, DLL injection, or by masquerading as a legitimate system process. Users often install it unknowingly bundled with free software.

Historical example: The Pegasus spyware, developed by the NSO Group, was documented by Citizen Lab researchers as being used to target journalists and activists by silently exploiting vulnerabilities in mobile operating systems.

Rootkits

A rootkit is designed to conceal the presence of malware — or of an attacker — on a compromised system. It modifies the operating system itself, including the kernel, system libraries, or boot process, so that standard detection tools cannot see malicious files or processes. Rootkits provide long-term, privileged persistence that is extremely difficult to remove without reimaging the system.

Historical example: The Sony BMG rootkit (2005) was hidden on music CDs. When a CD was inserted into a Windows PC, the rootkit installed itself silently to enforce copy protection, but also concealed any file beginning with a certain prefix — a technique that attackers quickly exploited.

Comparing the Six Types

| Malware Type | Requires User Action to Spread | Self-Replicates | Primary Goal |

|---|---|---|---|

| Virus | Yes | Yes (with host) | Damage / corruption |

| Worm | No | Yes (standalone) | Propagation / payload delivery |

| Trojan | Yes (tricked) | No | Backdoor / credential theft |

| Ransomware | Often tricked | Sometimes | Extortion |

| Spyware | Often tricked | No | Surveillance / data theft |

| Rootkit | No (installed by other malware) | No | Concealment / persistence |

Safety and Professional Ethics Note

Working with malware samples — even for analysis — requires strict controls. Always use isolated virtual machines with no network access to production systems. Never upload real customer files to public sandboxes; use only hashes or approved test files. Handling malware samples without authorization may violate the Computer Fraud and Abuse Act (CFAA) and organizational policy. Follow your organization's incident-response procedures and chain-of-custody requirements when preserving evidence.

Key terms9

MalwareAny software intentionally designed to cause damage, gain unauthorized access, or disrupt systems and data.
VirusMalware that attaches to a host file and replicates when that file is executed, requiring human action to spread.
WormSelf-replicating malware that spreads across networks without user interaction by exploiting software vulnerabilities.
Trojan (Trojan horse)Malware disguised as legitimate software; does not self-replicate but provides attackers with unauthorized access once installed.
RansomwareMalware that encrypts or locks a victim's data and demands payment for restoration of access.
SpywareMalware that secretly collects user activity, keystrokes, or credentials and transmits them to a remote party.
RootkitMalware that modifies the operating system or kernel to hide itself and other malicious activity from detection tools.
Persistence mechanismThe technique malware uses to remain active or re-launch after a system reboot, such as modifying registry run keys or scheduled tasks.
Infection vectorThe method by which malware initially enters or is delivered to a target system, such as email attachment, drive-by download, or network exploit.
In class: Read assigned textbook sections on malware taxonomy; complete a comparison matrix mapping each malware type to: infection vector, persistence mechanism, primary payload, and one documented historical incident. · Watch instructor-narrated walkthrough of VirusTotal submission results for two sample hashes (pre-selected benign test files); students record detection names, behavior tags, and sandbox results on a structured form. · Small-group analysis activity: each group receives a one-page incident description from a public post-incident report (e.g., a published government or CISA advisory) and identifies the malware type involved, justifying their answer with three evidence points from the text.
Materials: CompTIA Security+ SY0-701 study guide, VirusTotal web tool (sandbox results view), printed incident description handouts sourced from public CISA advisories, malware taxonomy comparison matrix worksheet
Check: Completed comparison matrix graded for accuracy; pass mark is 80% of cells correct. Group activity write-up must include all three required evidence points — pass requires all three present and accurately linked to the malware type.

Practice check8

Answer each question, then check it. Nothing is recorded; this is your own practice.

CompTIA Security+ — Threats, Attacks, and Vulnerabilities
1. A piece of malware spreads from system to system across a corporate network without any user opening a file or clicking a link. Which malware category best describes this behavior?
CompTIA Security+ — Threats, Attacks, and Vulnerabilities
2. An employee downloads a free video converter from a website. Days later, the company discovers that login credentials are being silently transmitted to an external server. The malware does not replicate to other machines. Which type of malware is most likely responsible?
CompTIA Security+ — Threats, Attacks, and Vulnerabilities
3. After a security incident, an analyst finds that standard Windows tools report no suspicious processes, but network monitoring detects outbound connections to an unknown IP address. Which malware type is most likely hiding the malicious process?
CompTIA Security+ — Threats, Attacks, and Vulnerabilities
4. The WannaCry outbreak in 2017 is best described as which combination of malware characteristics?
CompTIA Security+ — Threats, Attacks, and Vulnerabilities
5. Which characteristic most clearly distinguishes a Trojan from a worm?
ISC2 CC — Security Concepts
6. A hospital's file server suddenly shows that all patient records have been encrypted, and a text file demands payment in cryptocurrency. Staff can no longer access records. Which malware type caused this incident?
CompTIA CySA+ — Threat Intelligence
7. An incident report states that malware persisted on a compromised host by injecting code into the Windows kernel and that reimaging the hard drive was required for full remediation. Which malware type does this persistence method indicate?
CompTIA CySA+ — Threat and Vulnerability Management
8. During a threat analysis exercise, a student reviews a CISA advisory describing malware that: (1) arrived as an email attachment disguised as an invoice, (2) did not copy itself to other machines, and (3) established a remote-access channel for the attacker. Which malware category fits all three evidence points?
Record this lesson on my transcript. Sign in with your key and enrollment email to record lessons (enroll free if you have no key). This page stays open to read and practise.
← Previous lessonProgram planNext lesson →