11 — Malware and Ransomware

Level: Beginner · Time: ~20 min · Prerequisites: Lesson 10 — Web Application Attacks

Why this matters

Ransomware is the failure mode that ends companies. Not because the encryption is clever — it is not — but because it arrives quietly, spends days or weeks learning your network, and only becomes visible when it is already too late to stop it cheaply. Every other lesson in this module explains how something gets in; this one explains what the intruder runs once they are in, and what you can do about it. The single most important sentence in this lesson is that backups decide the outcome — almost everything else is about reducing the odds of needing them.

Nothing here is an instruction manual. Malware is described so you can recognise it, detect it and remove it, and every defence named is safe to implement on systems you own.

The mental model: malware is a business process, not a file

The mental picture most people carry — a virus that spreads when you open it — describes a world that ended around 2010. Modern malware is a supply chain with roles:

Somebody writes a loader and sells or rents it.
Somebody else gets access to a network and sells that access (an initial access broker).
An affiliate buys the access, deploys the payload, and keeps a share of the ransom.
A negotiation team handles the victim conversation, sometimes with a helpdesk-style portal.
A laundering layer collects and moves the payment.

Two consequences follow. First, the person who encrypts your files is rarely the person who broke in — which is why "we know who attacked us" is usually wrong and unhelpful. Second, because the model is industrial, the economics drive behaviour: they target whoever is easiest to reach, and they repeat whatever works, which is why the same handful of techniques appear in almost every incident.

A second mental model that pays off: malware wants to look ordinary. The successful sample is not dramatic. It uses signed binaries, built-in administration tools, and the same protocols your business uses all day. Detection therefore has to lean on behaviour and context rather than on file names.

The classes of malware

Class	What it does	How it moves
Virus	attaches itself to a legitimate file and runs when that file does	user shares the infected file
Worm	self-propagating; spreads on its own across a network	exploits an exposed service or reuses credentials with no user action
Trojan	looks useful, does something hostile	user installs it voluntarily
Backdoor	a hidden way in for later, without needing the original flaw again	installed by another stage, or intentionally shipped
Remote-access trojan (RAT)	gives an operator interactive control of the host	delivered by phishing or a loader
Rootkit / bootkit	hides files, processes and network activity from the operating system itself	installed with elevated rights; a bootkit starts before the OS
Keylogger	records keystrokes to capture credentials and messages	bundled with other malware or a fake installer
Infostealer	harvests browser-saved passwords, session cookies and crypto wallets in bulk	delivered as a loader's payload; often the first thing run
Dropper / loader	a small first stage whose only job is to fetch and run the real payload	phishing attachment, macro, or a malicious installer
Botnet agent	enrols the host in a network used for floods, spam or proxying	worm-like spread plus phishing
Cryptominer	uses the host's CPU and your cloud budget for someone else's profit	same delivery as other malware; often tolerated for weeks because nothing breaks
Wiper	destroys data with no recovery path, sometimes disguised as ransomware	deployed for disruption rather than profit
Fileless / living-off-the-land	uses only built-in tools — PowerShell, WMI, scheduled tasks — so little reaches disk	exploits or macros that launch built-in tools
Macro and document malware	a document's embedded macros do the work when the user enables content	email attachment
Mobile malware	abuses app permissions, overlays or accessibility services	sideloaded apps, hostile app stores, malicious adverts

Two notes that matter for defence. Infostealers are now the most common first payload, because a browser's saved passwords and live session cookies are immediately valuable and often bypass MFA entirely if the session is already authenticated. Fileless techniques defeat tools that only inspect files on disk, which is why command-line and script-block logging earn their place in any small network.

How it arrives

Delivery method	What it looks like in practice	The control
Phishing attachment	an invoice or CV that asks for macros to be enabled	mail filtering, attachment sandboxing, macro blocking, awareness
Phishing link	a page that harvests a credential or serves a download	mail and web filtering, phishing-resistant MFA, link scanning
Drive-by download	a compromised website or hostile advert exploits the browser or a plugin	patching, browser hardening, ad blocking, application updates
Exploiting an exposed service	an unpatched internet-facing VPN, mail server or web application	asset inventory, patching, exposure reduction, MFA on remote access
USB and removable media	found media, or an authorised device used to carry a payload in	device control, disable autorun, awareness
Malvertising	paid adverts on legitimate sites leading to hostile pages	ad blocking, browser hardening, patching
Trojanised installers and cracked software	free or "activated" software with an extra payload	software sourcing policy, allowlisting, no unlicensed installs
Remote-management tools abused	a genuine remote-support tool installed by a helpdesk — or by an attacker posing as one	change default credentials, MFA on the tool, allow an approved list, monitor installations
Supply-chain injection	hostile code arrives through a trusted vendor or update (Lesson 14)	vendor assessment, signed artefacts, staged updates

The uncomfortable truth in that table: most malware arrives either the way your business legitimately operates, or by exploiting something you already knew needed patching.

The infection chain, and what command and control looks like

Once inside, the sequence is remarkably consistent. Recognising the order is what lets you interrupt it.

Stage	What happens	Where it persists or hides	Typical detection source
Initial access	the user runs something, or a service is exploited	—	mail gateway, web proxy, service logs
Execution	the payload runs, often through a built-in scripting tool	—	process-creation telemetry with command lines
Persistence	a Run key, scheduled task, Windows service, cron entry, systemd unit, WMI subscription or login script keeps it alive	autostart locations (`HKCU\Software\Microsoft\Windows\CurrentVersion\Run`, Task Scheduler, `/etc/cron.d`, `/etc/systemd/system`)	autostart monitoring, change auditing, file-integrity monitoring
Privilege escalation	local admin is obtained to do more	—	privilege-use events, patching gaps, EDR rules
Defence evasion	security tools are disabled, logs cleared, or trusted signed binaries are used instead of custom ones	—	alerts on security-tool tampering and log-clearing
Command and control	the implant checks in for instructions	—	DNS logging, proxy logs, egress baselines
Discovery and lateral movement	the network is mapped and credentials reused	—	authentication logs, internal flow data (Lessons 13 and 44)
Collection and exfiltration	data is gathered, archived and uploaded	—	file-access auditing, egress volume baselines
Impact	encryption, destruction, or extortion without encryption	—	mass file-change detection, backup-console alerts

Command and control is the stage where the attacker is most exposed, so it is worth understanding what it looks like in traffic:

Beaconing — the implant contacts its infrastructure on a schedule. Real malware adds jitter, a random variation in the interval, to avoid looking like clockwork. Detection: periodic connections with a near-constant interval from a host that has no business making them.
Encrypted channels — nearly all command and control now runs over TLS on port 443, which is why blocking by port is useless. Detection: server name indicators, TLS fingerprints that do not match the claimed client, and connections to infrastructure the organisation has never used.
Abuse of legitimate services — the attacker uses a paste site, a code-hosting service or cloud storage as the middleman, so the traffic goes to a reputable provider. Detection: unusual upload patterns and new destinations, not a suspicious domain.
Domain generation algorithms (DGA) — the malware computes hundreds of candidate domains and tries them until one answers, so blocking a list never works. Detection: a burst of failed DNS lookups for random-looking names is a strong, cheap signal.
Fast flux — the same name resolves to many changing addresses, to keep the infrastructure alive. Detection: resolution churn against a single name, which is easy to spot in DNS logs.

Everything in that list is framed as a pattern you look for rather than a technique to build, and every one of them is visible in logs most organisations already keep but never read.

Ransomware: the modern business

Ransomware deserves its own section because it is the outcome that decides whether a company survives.

Element	How it works	What it means for you
Ransomware as a service	developers rent the encryption platform to affiliates for a share of the takings	the people attacking you are not the authors; there is no single "group" to reason about
Affiliates	the operators who break in, deploy and negotiate	their skill varies, but their playbook is consistent
Initial access brokers	professionals who only get in, then sell the access	a foothold you failed to notice may already be someone else's asset
Data theft before encryption	files are stolen first and used as extra leverage — double extortion; adding a denial-of-service or a call to your customers makes it triple	"we have backups" answers the encryption, not the leak
Dwell time	typically days or weeks between first access and encryption	you have a detection window — if anything is watching for it
Negotiation	a support-desk-style pressure campaign with proof-of-theft and deadlines	a policy agreed in advance beats a decision made at 03:00

Three practical consequences, in order of importance:

Backups decide the outcome. Encrypting your files is only fatal if you cannot restore. A backup that has never been restored is a belief, not a control; a backup reachable from your network with the same credentials can be deleted by the same attacker (as can shadow copies).
Patching, MFA and least privilege decide whether it happens. Ransomware almost always walks through a door that was already open: an unpatched internet-facing service, remote access without MFA, or a reused administrator credential.
Paying is a policy question, not an IT question. Payment funds the ecosystem, may be unlawful in some jurisdictions depending on who you are dealing with, does not guarantee a decryption tool that works, and does not stop the stolen data being resold. The decision should be made by management, in writing, before it is needed.

[!WARNING] The most common reason a ransomware incident becomes unrecoverable is not the encryption. It is that the attacker found and destroyed the recoverable copies — backups on the network, backup servers with shared credentials, and volume shadow copies — before triggering the payload.

Defending: what actually works, in priority order

Ordered by the difference each control makes. Note how many of them have nothing to do with malware detection.

Offline or immutable, tested backups. At least one copy that cannot be modified or deleted from the network, and a documented restore test. Everything else is secondary to this.
Patching, especially of anything internet-facing, on a schedule you can evidence.
MFA everywhere it can be enforced, particularly remote access, email and administrative accounts — and phishing-resistant methods where available, because a stolen password plus an approved prompt is not MFA in any useful sense.
Least privilege and remove local admin. Most malware needs administrative rights to persist deeply, disable protections, or move sideways.
Application allowlisting. Only approved software runs, which stops most commodity payloads regardless of what they contain.
EDR with behavioural detection. Blocks and records actions rather than comparing files to known-bad lists, which is what makes fileless and living-off-the-land attacks visible.
Macro and script blocking. Disable macros from the internet and constrain script interpreters for users who do not need them.
Email filtering, including attachment sandboxing and impersonation protection.
Network segmentation, so one compromised workstation is not adjacent to the file servers and the backup system.
Egress filtering, with outbound allowed only where the business needs it — this disrupts command and control and slows exfiltration.

Detection signals worth knowing

A process writing many files in a short time, and files whose extensions have changed in bulk.
Shadow copy deletion and, most telling of all, backup deletion through the management console by an account that never does that — that alert is worth more than a hundred signature hits.
Mass renames, or a sudden flood of files with an unfamiliar extension.
Unexpected outbound TLS to a domain with no history in your estate.
Remote-access utilities appearing on systems where they are not expected, including on servers.
Security tools being disabled, or logs being cleared.
A burst of DNS lookups for random-looking names, indicating a domain-generation algorithm.
Volume anomalies: a workstation reading gigabytes from a file share at two in the morning.

The first hour

If you believe encryption has started, the sequence is: isolate the affected systems from the network without powering them off (memory and running evidence are valuable, and a reboot may finish the job); protect the recovery paths first — disconnect and, if necessary, power down the backup infrastructure before anything else; identify patient zero and the account used; revoke credentials and sessions for that account; notify management, your insurer and, where required, your regulator; and decide whether you are restoring or rebuilding, with a rebuilt-from-trusted-media approach the safer default for anything that was administratively compromised. Lesson 45 covers the full playbook; the point here is that none of those steps work if the backups were reachable during the attack.

Attack it / Defend it

The attack	How it works	The control that stops it
Macro document in email	a document launches a payload when the user enables content	mail filtering, macro blocking, attachment sandboxing, awareness
Loader fetched from a hostile site	a small first stage downloads the real payload over HTTPS	web filtering, egress allowlists, application allowlisting, EDR
Autostart persistence	a Run key, scheduled task or service survives reboots	autostart monitoring, restricting who may create services and tasks, least privilege
Living-off-the-land execution	built-in tools do the work, so nothing new is written to disk	script-block and command-line logging, behaviour-based detection
Credential and cookie theft	an infostealer reads browser stores and session cookies	disk and cookie protection, phishing-resistant MFA, short session lifetimes
Command and control beaconing	periodic encrypted callbacks to attacker infrastructure	egress filtering, DNS logging, beacon-interval and TLS-fingerprint detection
Discovery and lateral movement	built-in administration protocols are used with stolen credentials	segmentation, no workstation-to-workstation file sharing, credential tiering
Data theft before encryption	files are archived and uploaded before the payload is triggered	egress baselines, data-loss prevention, alerting on bulk reads
Backup destruction	recovery paths are deleted via the management console or by shadow-copy deletion	immutable offline backups, separate backup credentials, alerting on backup deletion
Encryption at scale	files across shares are encrypted in minutes	segmentation, least privilege, mass-file-change detection, tested restore

Key takeaways

Malware is an industry, not an incident. Loaders, access sellers and affiliates are different businesses, which is why the playbook repeats and why the person who encrypts your files is not the person who found the door.
The best detection is behaviour, not file names. Look for how something acts — mass file writes, backup deletion, odd outbound traffic — rather than what it is called.
Backups decide the outcome, and only if they are unreachable and tested. An untested backup is a belief; a reachable one is a target.
Most of the controls that stop ransomware are not anti-malware controls: patching, MFA, least privilege, segmentation and egress filtering do the heavy lifting.
You have a detection window measured in days. Ransomware is rarely instantaneous, and the activities before it are detectable if anyone is looking.

Check yourself

Why is a modern ransomware incident usually at least two different criminal businesses working together, and what does that mean for how you respond?
Your backup runs nightly to a server on the same network with a shared administrator credential. Name two specific ways that fails during a real ransomware incident.
What is beaconing jitter, and what does the absence of jitter tell you when you see it in logs?
Give two detection signals that are behavioural rather than signature-based, and say which log source each needs.
Which of the ten defences listed would you implement first in a small business with no budget beyond staff time, and why that one?