What is Malware? The Different Types & How to Prevent Them

With so much news about malware, organizations everywhere are working to protect their systems, networks, software, and devices from infection. However, many are still primarily relying on detection-based solutions that malware can easily evade. Now more than ever, it’s important that organizations implement a malware prevention strategy that focuses on proactive defenses. Learning how to prevent, identify, detect, and respond to malware can help you secure data more effectively and keep your organization ahead of threats. 

Keep reading to learn more about the different types of malware to look out for, why you need a malware prevention strategy, and how Votiro can help.

What is Malware?

Short for “malicious software,” malware is intrusive code intentionally designed to destroy data, damage devices, and exploit networks or services. It can take the form of hardware, firmware, or software. 

Unlike traditional ransomware which encrypts data, threat actors use malware to steal sensitive information, including:

• Financial data
• Healthcare records
• Nonpublic personal information (NPI)
• Email addresses
• Passwords

Modern ransomware variants now incorporate many of the same tactics, techniques, and procedures (TTPs) that malware uses. Ransomware variants now steal data and hold it “hostage” until the victim pays the ransom. This makes it difficult to discuss one without understanding the other. 

The Different Malware Delivery Models

Malware can be delivered in different ways, often making it difficult to detect. 

Social engineering and email

Social engineering is when malicious actors prey on people’s emotions to get them to take an action against their best interests. Malicious actors engage in phishing, vishing, or smishing attacks. Additionally, the majority of social engineering attacks occur through email, according to the 2021 Data Breach Investigations Report (DBIR).

Remote desktop protocol (RDP)

RDP enables IT administrators to access a user’s machine remotely. Generally used to configure or help troubleshoot a machine, malicious actors can exploit the port used to make the connection. 

Drive-By-Downloads

When attackers take advantage of a known software vulnerability, they often deliver malware through compromised websites. Compromised websites don’t always look suspicious either, they can be a legitimate site that has a malicious ad installed. 

The Different Types of Malware

Just like malicious actors deliver malware through different methods, they also come in a plethora of varieties. 

1. Viruses

The most common attack variety, viruses are code snippets embedded into a file. Threat actors deliver viruses using email and websites. In order to make a copy of itself, or self-replication, the malware needs a program in which to embed itself. 

Often, viruses can be found in the following file types:

• .doc/.dox
• .exe
• .html
• .xls/.xlsx
• .zip

Once executed, the malware spreads across the systems and networks, infecting additional devices. 

2. Keyloggers

Also called keyboard capturing, keyloggers send a user’s keystrokes to the threat actor. While users don’t notice the program running, threat actors can steal sensitive information like data typed into a database or passwords. 

3. Worms

Normally, threat actors deliver a worm using a phishing campaign or through software vulnerability. Unlike a virus that must attach to a host program to run, worms don’t need a host program, making them effective against email servers, web servers, and databases. 

4. Trojans or Trojan Horses

Similar to the historic Trojan Horse, trojans hide inside legitimate code or software. After the user downloads it, the malware can “hide” on a device collecting data. Trojans can:

• Delete, modify, and capture data
• Use a device as part of a botnet
• Spy on the device
• Create backdoor access into systems and networks

Threat actors often deliver them via email. 

5. Ransomware/Crypto-Malware

Ransomware traditionally encrypts data, making it unintelligible to end-users. Recently, attacks also include data theft, where threat actors hold the information hostage until the company pays the demand. 

6. Logic Bombs

Often incorporated as part of a virus or worm, logic bombs activate the malware using a trigger event. The triggers can be a specific date, time, or the number of account logins, like on the 15th time a user logs in.

7. Bots/Botnets

Bots are task automation coding that malicious actors use to create a “robot network” or botnet. The bots remotely control the connected devices, botnet, sending requests to a network that ends in a Distributed Denial of Service (DDoS) attack. 

8. Adware

Although browser ad blockers make this less prominent, adware tracks users’ web search history. When someone downloads adware to their device, the adware sends “pop up” ads. Unlike other malware, adware is more annoying than harmful to data. 

9. Spyware

Spyware takes that snooping a bit further, installing on a device to capture keystrokes. 

10. Rootkits

A rootkit is a code that malicious actors use to gain control of a device. It creates a backdoor into the device, then hides its files, processes, modules, registry keys, and user accounts to remain unnoticed. Delivered using malicious attachments and downloads through phishing attacks, rootkits are difficult to remove. 

11. Fileless 

When downloaded, fileless malware uses native, software, applications and protocols on a device rather than requiring users to install and execute a program. Since the malware hides in the operating system’s processes and tools, it can be hard to detect. 

12. Mobile

Research has found that malware was hidden in 24 children’s games and 32 utility apps sold on Google Play in 2021. Mobile  malware can be used to bypass human verification mechanisms, steal encryption keys, and exploit operating system vulnerabilities 

The Importance of Malware Prevention 

Now that you understand the many different forms malware can take, it’s time to dig into why prevention is the primary way your organization can stay completely safe. These days, security measures such as sandboxing or anti-virus are no match for complex malware and new, zero-day malware or the sophisticated cybercriminals who execute it. When it comes to malware, organizations must shift from a reactive to a proactive approach.

A great way to prevent malware from infiltrating your organization is through file sanitization. The most advanced file sanitization scans files, identifies known good content, isolating the bad elements of a file. Once this process has been completed, the file is recreated with only the safest elements. This way, any malicious threats never have a chance to enter your network in the first place. File sanitization is just one example of the malware prevention measures you can take to protect your organization. Keep reading to learn a few of the other tactics you can try.

Malware Prevention Techniques

As mentioned, protecting against malware is becoming more difficult every day. Since threat actors know how anti-virus tools work, they also know how to evade them. As organizations continue to look for ways to protect information, they should consider some of the following best practices for malware prevention. 

File and software downloads 

Preventing users from downloading files and software mitigates malware risk. This includes limiting risky file types like PDFs that are often used to smuggle malware. 

Email security

Email security is one of the most successful malware risk mitigation strategies because this remains a primary attack vector. According to Proofpoint’s 2021 “State of the Phish,” 20% of email attachment phishing simulations failed at the organizational level, making them the biggest phishing risks.

Install security updates

Many malware variants leverage known software, hardware, and firmware vulnerabilities. Installing security updates as soon as possible mitigates risk arising from malware as well as other attack methodologies. 

Cyber awareness training

With social engineering a primary malware delivery model, organizations need to focus on training their employees to recognize phishing attacks. Phishing awareness training can help give employees practical experience and help organizations strengthen their security posture. However, while it reduces risk, one must know it is not foolproof. 

Strong password policy

Requiring employees to use unique, strong passwords for every application and login mitigates the risk that keylogger malware poses. If a keylogger captures one password, the malicious actor will be unable to use it to gain access to multiple resources or apply it to different accounts. 

Application privilege limitations

Creating network access controls and application-to-application controls limits how malicious actors can move within the organization’s systems and networks. Limiting what applications with risky privileges, like PowerShell, can do limits how malicious actors can leverage them as part of the attack. 

Data backup and recovery

Following best data backup and recovery processes reduces the impact of malware, like ransomware, that damages data integrity. Organizations should follow the 3-2-1 data backup best practices with 3 copies of data, in 2 formats, with 1 offsite. 

Endpoint security 

Although anti-virus software can’t eliminate malware, it does help mitigate risk. Known malware can be prevented by antivirus, it is unknown or zero-day malware that is likely to make it through. 

How to Prevent Malware Attacks with Votiro

With so many different malware types and delivery methods, and new ones arising every day, how do you detect and prevent all of them? The short answer is: you don’t, but you can greatly reduce risk if you take a proactive approach to malware prevention. 

Votiro keeps your network free from one of the most common types of malware delivery – malware hidden in files – using Positive Selection^® technology. Positive Selection technology sanitizes files not by looking for what’s bad, but by only allowing into an organization what is known to be good. This technique maintains full functionality of files (no blocking or quarantining), meaning business can go on as usual with no fear of becoming malware’s next victim from this threat vector. 

Want to learn more about how your organization can operate without the threat of malware? Schedule a demo with us today or contact us for more information.