Cybersecurity Foundations (Grades 6–8) · lesson 21 of 48 · 10 min
How Malware Gets In — Understanding Attack Vectors
Knowing that malware exists is not enough — you need to understand how it reaches your device. An attack vector is the path or method an attacker uses to deliver malware. Most malware infections happen through a small number of predictable, preventable vectors.
The good news: because these vectors are predictable, they are also defensible. Understanding them lets you make smarter decisions about every email you open, every link you click, and every USB drive you plug in.
By the end of this lesson you will be able to name the seven major malware delivery vectors, explain the attack chain from delivery to final action, identify risky vs. safe behaviours for each vector, and apply this knowledge to real-world scenarios.
The human factor
Most malware infections require some human action — clicking a link, opening a file, installing software. This is why security awareness training is so effective. An informed user who pauses and thinks before clicking is the best malware defence. Technical controls (antivirus, firewalls) are important, but they are the last line of defence — not the first.
The Seven Major Delivery Vectors
1. Email attachments — the most common vector. Malicious files disguised as invoices, shipping notices, or documents. Opening the attachment executes the malware. Never open unexpected attachments, even from known senders (their account may be compromised).
2. Malicious links — links in emails, texts, or social media that lead to sites that automatically download malware (drive-by downloads) or trick you into installing it.
3. Drive-by downloads — visiting a compromised or malicious website automatically downloads malware without any user action. Exploits browser or plugin vulnerabilities. Keeping your browser updated is the primary defence.
4. Infected USB drives — malware can spread via physical media. Plugging in an unknown USB drive can auto-execute malware. Never plug in USB drives you find or receive unexpectedly — this is a classic “baiting” attack.
5. Software downloads — downloading software from unofficial sources (pirated software, fake download sites) often bundles malware. Always download from official sources. Verify checksums when available.
6. Network propagation — worms spread across networks by exploiting vulnerabilities in connected devices. One infected device can compromise an entire network. Network segmentation and firewalls limit this.
7. Social engineering — tricking users into installing malware themselves. “Your computer has a virus — call this number” or “Download this tool to fix your slow computer.”
The Attack Chain
Most malware infections follow a predictable chain. Understanding this chain helps defenders know where to place their defences — and helps you understand why each step matters.
A typical ransomware attack chain
- Delivery An employee receives a phishing email with an attachment called “Invoice_2024.docx”. The email appears to come from a known vendor.
- Execution The employee opens the attachment. The document asks them to “Enable Macros” to view the content. They click Enable.
- Installation The macro downloads and runs ransomware from a remote server. The ransomware adds itself to startup entries (persistence).
- Command and Control (C2) The ransomware contacts the attacker’s server to receive the encryption key and confirm the infection.
- Action on objectives The ransomware silently encrypts every file it can reach — documents, photos, databases, backups. Then it displays the ransom note. Breaking the chain
Breaking any link in the attack chain stops the attack. Email filters catch phishing at step 1. User awareness stops execution at step 2. Application whitelisting prevents installation at step 3. Firewall rules block C2 at step 4. Backups enable recovery even if step 5 completes. Defence in depth means multiple opportunities to stop the attack.
Key Terms
Real-World Case Studies
Case 1: Stuxnet — The USB Worm That Attacked Nuclear Facilities (2010)
Stuxnet was a sophisticated worm believed to have been created by the US and Israel to sabotage Iran’s nuclear program. It spread via infected USB drives — targeting air-gapped systems (computers not connected to the internet). Once inside, it specifically targeted Siemens industrial control systems and caused centrifuges to spin at destructive speeds while reporting normal operation. Stuxnet demonstrated that even physically isolated systems are vulnerable to USB-based attacks. The lesson: never plug in unknown USB drives, even in secure environments.
Case 2: NotPetya — $10 Billion in Damage from a Software Update (2017)
NotPetya was disguised as ransomware but was actually a destructive wiper. It spread through a compromised update to M.E.Doc, a popular Ukrainian accounting software. Once installed, it spread across networks using the same EternalBlue exploit as WannaCry. It caused over $10 billion in damages globally, affecting Maersk (shipping), Merck (pharmaceuticals), FedEx, and many others. The lesson: software supply chain attacks — compromising legitimate software updates — are one of the most dangerous attack vectors.
Activity — Sort the Attack Vectors
Safe or Risky Behaviour?
- Downloading software from the official developer’s website
- safe
Official sources are the safest place to download software. The developer controls what is distributed.
- Opening an email attachment from an unknown sender
- risky
Unknown sender attachments are a primary malware delivery vector. Never open unexpected attachments.
- Plugging in a USB drive you found in the parking lot
- risky
Found USB drives are a classic baiting attack. They may auto-execute malware when plugged in.
- Keeping your browser and OS updated automatically
- safe
Updates patch vulnerabilities that drive-by downloads and other attacks exploit. Auto-updates are essential.
- Installing a cracked version of paid software from a torrent site
- risky
Pirated software is one of the most common malware delivery methods. The “crack” is often malware.
- Verifying a link destination by hovering before clicking
- safe
Checking the actual URL before clicking helps you avoid malicious links and phishing sites.
Knowledge Check
How Malware Spreads
The most common way malware is delivered is through:
- USB drives
- Email attachments and malicious links
- Network scanning
- Physical access
- Answer: Email attachments and malicious links
Email remains the primary malware delivery vector. Malicious attachments and links account for the majority of infections. A drive-by download occurs when:
- You download a file intentionally
- Malware downloads automatically just by visiting a compromised website
- You plug in a USB drive
- You install pirated software
- Answer: Malware downloads automatically just by visiting a compromised website
Drive-by downloads exploit browser or plugin vulnerabilities — no user action needed beyond visiting the page. You find a USB drive in the school parking lot. You should:
- Plug it in to see what is on it
- Give it to IT or security without plugging it in
- Format it and use it
- Throw it away immediately
- Answer: Give it to IT or security without plugging it in
Found USB drives are a classic baiting attack. Plugging in an unknown drive can auto-execute malware. Give it to IT. Malware “persistence” means:
- It is very difficult to remove
- It survives reboots by adding itself to startup processes
- It spreads to many computers
- It is very fast
- Answer: It survives reboots by adding itself to startup processes
Persistent malware adds itself to startup entries, scheduled tasks, or registry keys so it runs every time the computer starts. The C2 (Command and Control) server is used by attackers to:
- Store stolen data only
- Communicate with and control infected machines
- Host phishing sites
- Scan for vulnerabilities
- Answer: Communicate with and control infected machines
C2 servers receive data from infected machines and send instructions. Blocking C2 communication can neutralise malware even after infection. Stuxnet demonstrated that even air-gapped (offline) systems can be compromised via:
- Email attachments
- Drive-by downloads
- Infected USB drives
- Network scanning
- Answer: Infected USB drives
Stuxnet spread via USB drives to reach systems not connected to the internet. Physical media remains a real attack vector.
Previous lesson: Types of malware
Back to Cybersecurity Foundations (Grades 6–8)
Next lesson: Basic defense strategies