Types of malware

Cybersecurity Foundations (Grades 6–8) · lesson 20 of 48 · 12 min

Why Understanding Malware Types Matters

Malware (malicious software) is any program designed to damage, disrupt, or gain unauthorised access to a computer system. It is the most common cyber threat facing individuals, schools, businesses, and governments.

Understanding the different types of malware is not just academic — it directly affects how you defend against them. A ransomware attack requires a different response than a keylogger. A worm spreads differently than a Trojan. Knowing what you are dealing with determines what you do next.

By the end of this lesson you will be able to name and describe nine major malware types, explain how each one works and spreads, identify which type is being described in a scenario, and explain the best defence against each.

The scale of the problem

AV-TEST, a leading security research institute, registers over 450,000 new malware samples every day. That is more than 5 new malware programs every second. The global cost of cybercrime — much of it malware-driven — exceeded $8 trillion in 2023 and is projected to reach $10.5 trillion by 2025. Understanding malware is not optional for anyone who uses a computer.

The Nine Major Malware Types

Understanding how malware spreads helps you avoid it. Most malware infections happen through predictable, preventable vectors.

Key Malware Types in Depth

Virus vs. Worm: A virus needs a host file and requires user action (opening a file) to spread. A worm is self-contained and spreads automatically across networks without user interaction. Worms can spread much faster.

Trojan horse: Named after the Greek myth. Appears to be useful software (a game, a utility) but contains hidden malicious code. Unlike viruses, Trojans do not self-replicate — they rely on users installing them.

Ransomware: The fastest-growing malware category. Encrypts all your files, then demands payment (usually cryptocurrency) for the decryption key. Even if you pay, there is no guarantee you will get your files back. Backups are the best defence.

Rootkit: Designed to hide itself and other malware from antivirus tools and the operating system. Very difficult to detect and remove. Often requires reinstalling the OS.

Botnet: A network of infected computers (bots/zombies) controlled by an attacker (botmaster). Used for DDoS attacks, spam campaigns, and cryptocurrency mining. Your computer may be part of a botnet without you knowing.

Zero-day malware

Zero-day malware exploits vulnerabilities that have not yet been discovered or patched. Antivirus software cannot detect it because no signature exists yet. This is why keeping software updated is critical — patches close the vulnerabilities zero-days exploit.

Key Terms

Activity — Match the Malware Type

Malware Type Matching

Real-World Case Studies

Case 1: WannaCry Ransomware (2017)

WannaCry was a ransomware worm that infected over 200,000 computers in 150 countries in a single day. It exploited a Windows vulnerability called EternalBlue. The UK’s National Health Service was hit hardest — hospitals cancelled thousands of appointments, ambulances were diverted, and patient records were inaccessible. The attack caused an estimated $4–8 billion in damages. The Windows vulnerability had been patched two months earlier — every infected organisation had failed to apply the update. The lesson: patch your software.

Case 2: Mirai Botnet (2016)

The Mirai botnet infected hundreds of thousands of IoT devices (cameras, routers, DVRs) by scanning for devices using default passwords. It then used these devices to launch the largest DDoS attack ever recorded at the time, taking down major websites including Twitter, Netflix, Reddit, and CNN for hours. The attack traffic peaked at 1.2 terabits per second. The lesson: change default passwords on every device, including smart home devices.

Case 3: Emotet — The World’s Most Dangerous Malware

Emotet started as a banking Trojan in 2014 and evolved into a sophisticated malware delivery platform. It spread via phishing emails, installed itself as a Trojan, then downloaded additional malware including ransomware. At its peak, Emotet was responsible for 45% of all malicious email attachments globally. In 2021, a coordinated international law enforcement operation took down Emotet’s infrastructure. It returned in 2022. The lesson: malware evolves — staying informed and keeping defences updated is an ongoing process.

Activity — Malware Defence Scenarios

Malware Defence Decisions

Knowledge Check

A worm differs from a virus because:

Worms are less dangerous
Worms self-replicate across networks without user action
Worms require a host file
Worms only affect mobile devices
Answer: Worms self-replicate across networks without user action

Worms spread automatically — no user needs to open a file. This makes them much faster-spreading than viruses. Ransomware attacks work by:

Deleting your files
Encrypting your files and demanding payment
Slowing your computer
Stealing your passwords
Answer: Encrypting your files and demanding payment

Ransomware encrypts files making them inaccessible, then demands cryptocurrency payment for the decryption key. A Trojan horse is malware that:

Spreads automatically
Disguises itself as legitimate software
Only attacks Trojans
Hides from antivirus
Answer: Disguises itself as legitimate software

Like the Greek myth, a Trojan appears useful (a game, a tool) but contains hidden malicious code. A rootkit is designed to:

Encrypt files
Hide itself and other malware from detection
Send spam
Mine cryptocurrency
Answer: Hide itself and other malware from detection

Rootkits are stealth malware — they modify the OS to hide their presence from antivirus tools and system administrators. Your computer could be part of a botnet if:

You have antivirus installed
It is infected with malware that allows remote control
You use public Wi-Fi
You have a slow internet connection
Answer: It is infected with malware that allows remote control

Botnet malware runs silently in the background. Your computer may be sending spam or participating in DDoS attacks without you knowing. The WannaCry ransomware attack could have been prevented by:

Using a VPN
Applying the available Windows security patch
Using a stronger password
Disabling Wi-Fi
Answer: Applying the available Windows security patch

Microsoft had patched the EternalBlue vulnerability 60 days before WannaCry. All 200,000+ victims had not applied the patch.

Previous lesson: Files, users, and permissions
Back to Cybersecurity Foundations (Grades 6–8)
Next lesson: How malware spreads