Malware Types and Defenses

Malware — malicious software engineered to infiltrate, damage, or extract value from computing systems — represents the operational core of most cybercrime activity tracked by federal enforcement bodies. This page covers the primary classification taxonomy, infection and execution mechanics, documented deployment scenarios, and the framework-aligned defensive postures applied across sectors. The FBI's Internet Crime Complaint Center (IC3 2022 Internet Crime Report) attributed over $10.3 billion in cybercrime losses to incidents where malware or malware-adjacent techniques played a direct role.

Definition and Scope

Malware is any software intentionally designed to disrupt, damage, gain unauthorized access to, or exfiltrate data from a computing system, network, or device without the owner's informed consent. The scope covers executable code, scripts, macro-embedded documents, firmware implants, and interpreted payloads delivered across network, physical, or supply-chain vectors.

NIST Special Publication 800-83, Rev 1 — Guide to Malware Incident Prevention and Handling for Desktops and Laptops — provides the primary federal taxonomy for malware classification used by US agencies. Under that taxonomy, the principal categories are:

  1. Virus — Self-replicating code that attaches to legitimate executable files and requires host execution to propagate.
  2. Worm — Self-propagating malware that traverses networks autonomously without requiring a host file or user action.
  3. Trojan horse — Malicious code disguised as legitimate software, relying on user execution rather than self-replication.
  4. Ransomware — Malware that encrypts victim data or locks system access, then demands payment for restoration. The CISA Ransomware Guide (co-published with MS-ISAC) classifies ransomware as a distinct threat category requiring a dedicated response playbook.
  5. Spyware and adware — Software that covertly monitors user activity, captures credentials, or redirects browser behavior for unauthorized commercial or intelligence purposes.
  6. Rootkit — Malware that embeds at the kernel, firmware, or hypervisor level to conceal its presence and maintain persistent privileged access.
  7. Botnet malware — Code that enrolls compromised hosts into a command-and-control (C2) network for coordinated attacks, spam distribution, or distributed denial-of-service (DDoS) operations.
  8. Fileless malware — Payloads that operate entirely in memory or abuse legitimate system tools (such as PowerShell or WMI), leaving minimal disk artifacts.

Regulatory frameworks including NIST Cybersecurity Framework 2.0 and the HIPAA Security Rule (45 CFR Part 164) treat malware protection as a baseline control obligation, not an optional hardening measure. For covered healthcare entities, the HIPAA Security Rule at §164.306 specifically requires protection against reasonably anticipated threats to electronic protected health information.

How It Works

Malware deployment follows a recognizable operational lifecycle, commonly mapped to the MITRE ATT&CK framework's tactic categories (MITRE ATT&CK Enterprise Matrix):

  1. Initial Access — Entry via phishing email, drive-by download, exploit of a public-facing application, or compromised supply-chain software. The Verizon 2023 Data Breach Investigations Report identified phishing as the initial vector in a significant proportion of confirmed breaches.
  2. Execution — The payload activates, either through user interaction (opening a document, running an installer) or through automated exploitation of a vulnerability.
  3. Persistence — Malware establishes mechanisms — registry keys, scheduled tasks, modified boot sectors, or firmware implants — to survive reboots and credential rotations.
  4. Privilege Escalation — The malware attempts to gain administrative or SYSTEM-level rights using exploits, token manipulation, or credential harvesting tools such as Mimikatz.
  5. Defense Evasion — Techniques include disabling antivirus processes, injecting code into legitimate processes, obfuscating payloads, or abusing signed binaries (a technique MITRE classifies as "Living off the Land").
  6. Command and Control (C2) — Infected hosts beacon outbound to attacker-controlled infrastructure, often over HTTPS on port 443 to blend with normal traffic, awaiting instructions.
  7. Impact — Depending on malware type: data exfiltration, encryption and ransom demand, credential theft, or system destruction.

Ransomware vs. wiper malware represents a critical classification boundary: ransomware preserves data integrity while withholding access (to enable payment), whereas wiper malware — such as the NotPetya variant analyzed by CISA — destroys data permanently with no recovery path. Organizations using ransomware incident response playbooks that assume data recoverability may respond incorrectly to a wiper event.

Common Scenarios

Healthcare sector: Ransomware targeting electronic health record (EHR) systems forces hospitals to revert to paper-based processes. The HHS Office for Civil Rights (OCR Ransomware Guidance) confirms that ransomware attacks constituting unauthorized access to ePHI constitute HIPAA breaches requiring notification.

Financial services: Banking trojans such as the Zeus family target credential input fields in browsers to intercept online banking authentication. The FFIEC Cybersecurity Resource Guide establishes baseline expectations for financial institutions managing this threat class.

Critical infrastructure: Industrial control system (ICS) environments face targeted malware — such as the Industroyer/Crashoverride family — engineered to manipulate operational technology (OT) protocols. CISA ICS-CERT advisories document active campaigns against energy, water, and manufacturing sectors.

Supply-chain compromise: Malware inserted into software updates or open-source dependencies infects downstream customers at scale. The SolarWinds incident (analyzed in CISA Alert AA20-352A) demonstrated how a single compromised build pipeline can propagate malware across 18,000 organizations simultaneously.

Professionals navigating service providers in these sectors can reference the Cyber Safety Listings for categorized entries by specialty and sector coverage.

Decision Boundaries

Selecting the appropriate defensive posture requires mapping malware type to control category. The NIST SP 800-53 Rev 5 control catalog — specifically the SI (System and Information Integrity) family — defines baseline malware protection requirements for federal systems, with SI-3 mandating malicious code protection and SI-7 covering software and firmware integrity verification.

Signature-based vs. behavior-based detection — Signature-based antivirus identifies known malware by matching binary patterns against a database. Behavior-based (heuristic or EDR-class) detection identifies malicious activity patterns regardless of whether a signature exists, making it the appropriate primary control against fileless malware and zero-day exploits. Organizations operating under FedRAMP authorization requirements must demonstrate endpoint detection and response (EDR) capability that goes beyond signature-only controls.

When containment takes precedence over eradication: In ransomware incidents where encryption is active, network segmentation and system isolation must precede any eradication attempt. Premature removal of the malware binary without halting encryption processes accelerates data loss. CISA's Ransomware Guide structures incident response into three phases — Preparation, Response, and Prevention After Incident — specifically to address this sequencing problem.

The purpose and scope of this directory provides additional context on how malware-related service categories are classified within this reference structure. Organizations assessing vendor qualifications for incident response can consult the Cyber Safety Listings to identify relevant service categories by threat type.

Regulatory obligations triggered by malware incidents vary by sector: HIPAA-covered entities must assess ransomware events as presumptive breaches (HHS OCR Guidance), while operators of critical infrastructure are subject to mandatory incident reporting under CIRCIA (Cyber Incident Reporting for Critical Infrastructure Act of 2022), which requires covered entities to report significant cyber incidents to CISA within 72 hours of reasonable belief that an incident has occurred.

References

📜 1 regulatory citation referenced  ·  🔍 Monitored by ANA Regulatory Watch  ·  View update log

Read Next

Cyber Safety Listings Each entry is structured to support service seekers, compliance professionals, and researchers who need to identify qualified... Cyber Safety Directory: Purpose and Scope Entries span federal agencies, independent service providers, standards bodies, and sector-specific compliance resources. How to Use This Cyber Safety Resource The Cyber Safety Listings index presents categorized service provider information, while the Directory Purpose and Scope page...