Malware Then and Now: Viruses to Ransomware

Malware Then and Now: Viruses to Ransomware

What you'll learn

• Classify malware with the classic taxonomy: virus, macro virus, worm, trojan, spyware — and say why the labels blur
• Explain ransomware — the missing chapter — and read its 2026 statistics like a professional
• Describe how attackers actually get in today: credential abuse, vulnerability exploitation, and the human channel
• Place botnets and DDoS in the picture
• Assemble the defense baseline that counters most of it — from controls you already learned

The classic taxonomy: five names worth keeping

This lesson builds on Chapter 15 of Dr. Tahseen Al-Doori's Network Essentials, which opens its malware section with a linguist's sigh: labels in computing refuse to hold still, and nowhere do they slip more than in malicious software — malware, the umbrella over every program written to do harm. The book's taxonomy remains the field's shared vocabulary, so learn it as the book teaches it:

• A virus attaches itself to a host — a file, a program — and self-replicates on a machine when the host runs. Like its biological namesake, it needs a carrier and it needs execution.
• A macro virus lives inside a document rather than a program, riding the scripting (macro) capability of office file formats. It matters double today: document macros remain a live infection channel, as this lesson's lab will show.
• A worm self-replicates across a network — no host file, no waiting for a user; it spreads machine to machine on its own, which is why worm outbreaks are measured in hours.
• A trojan horse is harm wearing a costume: a program that presents as useful — a free utility, a game, a "codec," fake antivirus software — and does its real work once invited in. It does not self-replicate; it recruits you for distribution.
• Spyware watches: interests, keystrokes, habits — originally to feed advertising, in darker forms to steal credentials outright.

The book adds the label that explains why labels fail: polymorphic — malware that rewrites its own appearance to evade recognition. And its practical wisdom holds perfectly: real campaigns combine the categories. A document macro (macro virus) fetches a payload that spreads laterally (worm behavior) while presenting as an invoice reader (trojan) and harvesting passwords (spyware). Ask "what does it do?" rather than "what is it called?" — the taxonomy is a toolkit for description, not a filing requirement.

The book's classroom question about infiltration routes also deserves its modern echo. Its era's answers — email attachments, USB sticks, free software, document scripts — are all still live channels. What changed is what tops the list, and that story needs its own section.

The missing chapter: ransomware

One species dominates the modern landscape so thoroughly that its absence from the book's taxonomy is the clearest possible timestamp. Ransomware is malware that encrypts your data and sells it back to you: it applies lesson 3's strong cryptography — the same AES your defenses use — with a key only the attacker holds, then presents a ransom demand, payment expected in cryptocurrency. Modern operations run double extortion: before encrypting, they steal the data, so paying for decryption still leaves the threat of publication — a second lever, aimed at exactly the confidentiality obligations lesson 1 taught you to catalog.

Why did this species take over? Because it solved crime's oldest problem: monetization. The book's era of malware struggled to turn infections into money — spam relays, stolen card numbers with fences and middlemen. Ransomware skips all of it: the victim is the buyer, the data's value is set by its owner's need for it, and cryptocurrency moves the payment. Around that engine grew an industry — ransomware-as-a-service, where developers lease the tooling and affiliates run the attacks for a revenue share, with negotiation portals and customer support. Industrialized, franchised, efficient.

The numbers say the rest, and they are worth quoting precisely because they retire any notion that this is a big-company problem. As of the Verizon 2026 Data Breach Investigations Report, ransomware appears in 48 percent of analyzed breaches, and small organizations make up the overwhelming majority of named victims. Read that second finding twice: the small office with one server and no IT department is not beneath this threat's notice; it is the primary habitat — softer defenses, no negotiating leverage, and often no survivable backups. Lesson 1's aside about organizations failing after catastrophic data loss stopped being hypothetical the year ransomware industrialized; the lab below walks one such case end to end.

How they get in: the modern initial-access picture

Here the course must update not the book's facts but the folklore many students arrive with. Ask a room how breaches begin and the reflex answer is "phishing." The current data draws a more precise picture, and precision matters because defenses follow from it.

As of the 2026 DBIR, one route now leads clearly. Vulnerability exploitation stands at 31 percent of breaches — enough to overtake stolen credentials as the top way in for the first time in the report's history. The two front-runners, in order. Vulnerability exploitation — lesson 1's vocabulary made kinetic: unpatched software, with Internet-facing edge devices (VPN concentrators, firewalls, file-transfer appliances) the prized targets, because one flaw there opens many networks at once; attackers automate exploitation within days — sometimes hours — of a flaw's publication, a tempo the book's era already observed and the intervening years only accelerated. Credential abuse — walking in the front door with valid stolen credentials: passwords harvested by earlier breaches and infostealer malware, reused across sites (lesson 4's reuse warning, realized at scale), sprayed against VPN portals and the exposed RDP doors lesson 5 warned about. No exploit, no alarm — just a login that looks legitimate until the accounting logs are read. It slipped to second place at the front door in the 2026 data, but it remains the most pervasive technique when counted anywhere along the attack chain — which is why it stays a first-order defense priority.

And phishing and social engineering? Still enormous — the major human channel, and the way many of those credentials get stolen in the first place — but no longer the top initial-access vector in the breach data. The craft has industrialized past the misspelled lottery email: pretexting (invented scenarios — a "supplier" with an urgent invoice, "IT" needing a password reset), urgency and authority as pressure tools, lookalike login pages that defeat everything except lesson 4's passkeys, and voice and text variants of every trick. The professional takeaway is a triangle, not a slogan: patch what faces the Internet (now the single largest door), defend credentials (MFA, passkeys), and train and support the humans — because the three channels feed each other, and a defense plan built on only the famous one leaves the current leaders unguarded.

One more citizen of the landscape completes it, one paragraph as promised: the botnet — thousands to millions of compromised machines under one operator's command. Increasingly its recruits are not PCs but the weak-defaulted IoT devices Module 3 taught you to quarantine in their own VLAN: cameras, sensors, routers with factory passwords. Botnets send spam and stage fraud, but their signature weapon is the DDoS — distributed denial of service — aiming massed junk traffic at a victim to exhaust its capacity: an attack on the availability corner of lesson 4's CIA triad, no data stolen, everything simply stopped. Defense at that scale is a provider-level service; your contribution is refusing to donate recruits — which is exactly what patching and segmentation do.

The defense baseline: five controls that move the numbers

Now assemble the module. Everything in the threat picture above has a counter you have already learned; what follows is the short list — the baseline any person or small office can actually run.

1. Update relentlessly. Patching closes the vulnerabilities that exploitation-led access depends on. Automatic updates on; Internet-facing devices first; the book's era asked when you last updated your antivirus signatures — the 2026 form of that same hygiene question is when did your edge device last get firmware?
2. MFA everywhere — passkeys where possible. Credential abuse leads the breach data, and lesson 4's multiplication is its counter: a stolen password alone stops working. Phishing-resistant passkeys defeat even the convincing clone page.
3. Backups on the 3-2-1 pattern — with one copy offline. Three copies, two media, one off-site — Module 8 builds this properly; this lesson supplies the security-side motivation: ransomware hunts backups first, because a victim who can restore will not pay. An always-connected backup drive is one more thing to encrypt; the offline copy is the one that survives — and it converts the ransom demand from an existential threat to a bad weekend.
4. Least privilege, segmented. Lesson 4's RBAC bounds what any one compromised account can reach; Module 3's VLANs bound what any one compromised machine can reach. Blast-radius thinking, from lesson 1, applied in advance.
5. Endpoint protection plus suspicion, culturally installed. The book's antivirus advice grew into modern endpoint tooling (EDR — detection and response on the device, watching behavior rather than only signatures), but the cultural control matters as much: unexpected attachments and urgent requests get verified out-of-band, macros stay disabled unless justified — and reporting a suspected click is praised, never punished, because the report is what starts the response clock.

Notice what the list is: lesson 1's layered defense, itemized. No single control counters everything; the five together counter most things — and the lab now shows what happens when several are missing at once.

Lab: The Harbor Lane incident — reconstruct the chain

Incident analysis is threat modeling in reverse: given the wreckage, recover the story. You will work a fictional but true-to-pattern small-business ransomware case from its evidence.

Objective. Order eight evidence items into the attack chain, name the stage each represents, identify the initial-access vector, and specify which baseline controls would have broken the chain — and where.

Setup. Paper or a document. The case: Harbor Lane Printworks, a 14-person print shop — one file server, one backup NAS, office PCs, the owner's "IT is whoever is free" policy. On a Saturday morning, every screen shows a ransom note. The evidence below is presented in the order investigators found it — not the order it happened.

The evidence.

• E1. Ransom note on every PC (Saturday): files renamed with a strange extension; the note demands cryptocurrency payment and threatens to publish "your customer files" — proof of theft included.
• E2. Firewall logs (three weeks back): minutes after E5's email was opened, the office manager's PC began small, regular outbound connections to an unfamiliar address — every few minutes, around the clock, continuing to the present.
• E3. File-server audit (ten days back): real-time antivirus protection was switched off via an administrator account; the alert email went to an unmonitored mailbox.
• E4. Server logs (two weeks back): repeated successful after-hours RDP logons to the file server using the office manager's account — a person who has never used RDP and was home asleep.
• E5. The office manager's mailbox (three weeks back): an email from a "paper supplier" — a reply to a real earlier thread — with attachment PriceList_Q3.xlsm. The shop runs an old, unmanaged Office build on which the modern internet-macro block was never enforced; she remembers the file "looked broken" and that she clicked Enable Content as the document suggested.
• E6. Domain audit (two weeks back): a new account, svc-backup2, created and quietly added to the administrators group. No one recalls creating it; the name resembles the legitimate svc-backup.
• E7. Bandwidth graphs (final week): roughly 40 GB uploaded to a consumer cloud-storage service across three consecutive nights — a business that uploads almost nothing, exporting itself.
• E8. Backup check (Saturday): the backup NAS was encrypted before the file server; the USB drive plugged into the server — the "extra backup" — encrypted with it. The only surviving copy: a two-month-old drive in the owner's desk.

Steps.

1. Draw a timeline from three weeks ago to Saturday; place each evidence item on it (the discovery order is deliberately scrambled — the dates in each item are your guide).
2. Label each item with the stage of the chain it evidences, choosing from: initial access · foothold/persistence (command and control) · credential theft or misuse · privilege escalation · defense evasion · data exfiltration · destruction of recovery · encryption and extortion. Some stages have more than one item; one item may show two stages.
3. Write the attack narrative in eight to ten sentences, in chronological order, naming the initial-access vector precisely (which taxonomy members does E5 involve?).
4. List three controls from this module's baseline that would have broken this chain, and mark where on your timeline each would have cut it.
5. Answer the owner's question — "do we pay?" — with one paragraph weighing E8 against E1's publication threat, honestly.

Deliverable. Timeline, labeled stages, narrative, three break-points, and the payment paragraph.

Model answer (compare after finishing).

Chronology and stages: E5 → E2 → E4 → E6 → E3 → E7 → E8 → E1. E5 is initial access — a pretexted email (social engineering) delivering a macro-enabled document: a macro virus riding a trojan's costume, with Enable Content as the human click that armed it. E2 is the foothold — beaconing to command-and-control from the compromised PC. E4 is credential misuse — the manager's credentials, harvested by the implant, reused for after-hours RDP onto the server (spyware behavior feeding lesson 5's warned-about door, here inside the LAN). E6 is privilege escalation and persistence — an attacker-controlled admin account camouflaged as a service name. E3 is defense evasion — antivirus off, alert unread. E7 is exfiltration — the 40 GB is the customer data, staged for double extortion. E8 is destruction of recovery — backups hunted and encrypted first, exactly as the baseline section warned. E1 is encryption and extortion, the only stage the victim was ever meant to see.

Three break-points (any three of these earn full credit): macros disabled by policy (cuts at E5); MFA on the manager's account and on server RDP (cuts at E4 — stolen password alone stops working); the offline 3-2-1 backup copy (converts E8 from catastrophe to recovery plan); an egress rule or alert on unusual outbound volume (exposes E2/E7 weeks early); monitored security alerts (E3 becomes a Tuesday incident instead of a Saturday disaster); least-privilege review catching a new admin account (E6).

Payment paragraph, model reasoning: With only a two-month-old backup, refusing payment means real loss — but payment buys a criminal's promise: decryption may fail or be slow, the stolen data (E7) remains in attacker hands regardless, and publication leverage survives any payment. Authorities and insurers consistently advise against paying and for reporting. The honest answer: restore what the old drive holds, engage professional response and law enforcement, notify affected customers as regulation requires — and fund the baseline, because the ransom's true price was five missing controls.

If it goes wrong. If your chronology differs slightly (E4 and E6 can plausibly swap), grade yourself on the logic of dependencies: access before foothold, credentials before escalation, evasion before exfiltration, backups before encryption — the dependency order is the learning, not the exact dates. If you found fewer than three break-points, re-read the baseline section: every one of its five controls appears in this chain's failure list.

Check yourself

1. Classify each, taxonomy names only: a spreadsheet whose embedded script runs on opening · a "free PDF converter" that also installs a keylogger · code that spreads server-to-server overnight with no user action · a browser extension quietly logging shopping habits · malware that rewrites its own signature at each infection.
2. A colleague says: "We're a nine-person firm — ransomware gangs target corporations, not us." Correct this with the two 2026 figures from this lesson, properly cited, and one sentence on why small firms attract the attention.
3. Another colleague: "Phishing is how all breaches start, so awareness training is the whole answer." Deliver the precise correction — what actually leads initial access as of the current data, and the defense triangle that follows.
4. Why does ransomware hunt backups before encrypting production data — and which single property of a backup copy defeats that hunt? Name the pattern and the module that formalizes it.
5. The Harbor Lane attackers used valid credentials for their RDP logons, and E4 shows the logons succeeded without alarms. Which of lesson 4's three As failed at Harbor Lane — and which control from that lesson would have made E4's stolen password worthless?
6. Your home router still runs its factory password and two-year-old firmware. Connect this to the botnet paragraph: what exactly are you risking, who suffers, and which two baseline controls apply?

Answers

1. Macro virus · trojan carrying spyware (the costume and the payload — labels describing behaviors, as the lesson said) · worm · spyware · polymorphic malware.
2. As of the Verizon 2026 DBIR, ransomware appears in 48 percent of breaches overall, and small organizations are the overwhelming majority of named victims. Small firms are the primary habitat, not an afterthought: softer defenses, no security staff, and backups that often share the server's fate — attackers industrialized precisely because such targets are plentiful and quick.
3. Phishing is the major human channel but no longer the top vector — and as of the 2026 DBIR neither is credential abuse: vulnerability exploitation leads at 31 percent, ahead of stolen credentials for the first time. The defense triangle: MFA/passkeys against stolen credentials, relentless patching (edge devices first) against exploitation, and training plus a blame-free reporting culture for the human channel — all three, because each feeds the others.
4. A victim who can restore will not pay — recoverability is the ransom's competition, so it is destroyed first (E8 in the lab). The defeating property is disconnection: a copy that is offline (or immutable) cannot be encrypted by malware that owns the network. The pattern is 3-2-1 — three copies, two media, one off-site/offline — formalized in Module 8.
5. Accounting failed: the logons were logged — after-hours, from an account that never uses RDP — and nobody was reading; authentication technically worked, which is exactly the problem with valid stolen credentials. MFA (lesson 4) would have demanded a second factor the attackers did not hold, turning E4's password into a dead end.
6. You are offering a recruit: weak-defaulted, unpatched devices are exactly what botnets conscript. The direct sufferer is someone else — the DDoS victim your router helps flood — plus you, hosting a stranger's foothold. Controls one (update firmware, change the default password) and four (segment IoT in its own VLAN, per Module 3) apply directly.

Key terms

• Malware — software written to do harm; the umbrella term.
• Virus / macro virus — self-replicating code needing a host file and execution; the document-borne variant riding office macros.
• Worm — self-spreading across networks without user action; the fast one.
• Trojan horse — harm presenting as something wanted; recruits the user as its installer.
• Spyware — surveillance software: interests, keystrokes, credentials.
• Polymorphic — self-rewriting to evade recognition; why signature-only defense lost.
• Ransomware — encrypts data and sells it back; the modern landscape's dominant species (48% of breaches, small organizations the majority of victims — DBIR 2026).
• Double extortion — steal first, then encrypt: payment for decryption still leaves publication leverage.
• Ransomware-as-a-service — the franchise model: developers lease tooling, affiliates attack, revenue shared.
• Credential abuse — initial access via valid stolen logins; a co-leader of the current breach data.
• Vulnerability exploitation — initial access via unpatched flaws, edge devices first; the other co-leader.
• Phishing / pretexting / social engineering — the human channel: deception, urgency, authority, lookalike pages.
• Botnet / DDoS — herds of compromised machines (increasingly IoT); massed traffic attacks on availability.
• EDR — endpoint detection and response: behavior-watching successor to signature antivirus.
• 3-2-1 backups — three copies, two media, one offline/off-site; ransomware's competition (formalized in Module 8).

Summary

• The book's taxonomy — virus, macro virus, worm, trojan, spyware, with polymorphic as the shape-shifter label — remains the working vocabulary; real campaigns combine categories, so describe behavior, not just names.
• Ransomware is the missing chapter: encryption turned extortion engine, industrialized as a service — 48 percent of breaches, with small organizations the majority of victims, as of the Verizon 2026 DBIR. Small is not safe; small is the habitat.
• Initial access today is led by credential abuse and vulnerability exploitation, with phishing the major human channel — defend all three corners, not just the famous one.
• Botnets conscript the unpatched — increasingly IoT — and spend them on DDoS attacks against availability; refuse to donate recruits.
• The baseline is this module itemized: updates, MFA/passkeys, 3-2-1 backups with an offline copy, least privilege plus segmentation, EDR plus a blame-free reporting culture.
• The Harbor Lane chain — macro to beacon to stolen credentials to admin persistence to exfiltration to murdered backups to ransom — fails at every baseline control; that is the point of having five.
• Module 7 complete: threats, firewalls, encryption, identity, tunnels, malware. Download: Module 7 Cheat Sheet (the whole defensive stack on one page — worth printing before the capstone asks you to defend a design of your own).

Next lesson

Module 8 turns from defense to operations: the command-line toolkit every professional carries — ping, traceroute, DNS interrogation, connection tables — followed by Wireshark investigations, backup and uptime arithmetic (the 3-2-1 promised here), and the troubleshooting method that ties the whole course together.

Sources and further study

• Al-Doori, T., Network Essentials, Chapter 15 — the malware taxonomy, infiltration-routes discussion and update-hygiene teaching this lesson builds on.
• Verizon, 2026 Data Breach Investigations Report — https://www.verizon.com/business/resources/reports/dbir/ — the ransomware and initial-access figures cited throughout; re-check the live edition yearly.
• CISA, StopRansomware — https://www.cisa.gov/stopransomware — the US government's consolidated guidance, advisories and no-cost resources; the official word on payment.
• NIST SP 800-63B-4, Digital Identity Guidelines — https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63B-4.pdf — the credential-defense side of this lesson's baseline, from lesson 4.