Author: kanishka10

Hello aspiring Ethical Hackers. In this blogpost, you will learn about steganography. Before you learn what is it, you need to learn why are we learning about it. In Feb 2023, Red Eyes Hacking Group (APT37) used a jpg image as attachment in one of their spear phishing email. When victims clicked on this image, it triggered an exploit that ran shellcode on the victim’s computer to download and execute a malicious payload that is stored within the jpg file mentioned above. But how was the malicious payload was hidden inside the jpg image?

What is Steganography?

It is an art or technique of hiding secret or any precious information inside something that looks common & ordinary. This information is hidden in such a manner that its presence is not evident to the human inspection. The word stegano graphy came from Greek word steganographic, that is combination of words steganos (meaning hidden or concealed) and graphia (writing).

In ancient and medieval times, kings used steganography to forward messages secretly. Greeks were the fist to use it. Coming to modern times, hackers are using it to hide malicious code in images, text, files, audio, video film and any other medium that looks benign.

Types of Steganography

There are five types of stegano graphy. They are,

1. Text stegano graphy
2. Image stegano graphy
3. Video stegano graphy
4. Audio stegano graphy
5. Network Stegano graphy

1. Text Steganography::

In text steganography, the secret information is hidden in a piece of text. For example, let’s say a text contains “Indians love Unity”. This may look like an ordinary or normal text. But just take the first letter of these three words. That becomes “ILU” a shortcut for I Love You message used by youngsters.

2. Image Stegano graphy:

As you might have already expected, when the secret information is hidden in an image (digital image) it is known as Image steganography.

3. Audio Steganography:

If the information we want to hide is hidden in an audio, it is known as audio steganography. Humans can hear sound that only contains certain frequencies. So, by altering the properties of audio like frequency, amplitude etc. secret messages can be hidden. However, to be able to receive and understand this secret information, the receiver needs to have smart listening devices to decipher the hidden information.

4. Video Steganography:

If the secret information is hidden in a video, it is called video steganography. A video is simply a representation of a sequence of consecutive images. So, we can say that this is an advanced version of Image steganography.

5. Network Steganography:

Considered to be more advanced and practically useful to Black Hat Hackers, in Network steganography information is hidden in network traffic. For example, it can be hidden in the TCP/IP headers etc.

Examples of Steganography attacks in hacking

1. In September 2022, researchers at ESET discovered a previously unknown Threat actor they named Worok hiding malicious payload in PNG files.
2. In 2019, researchers at Symantec observed a Russian cybersecurity group waterbug (also known as just the malicious) delivering a publicly known backdoor by hiding it in a WAV file.
3. In the same year, security researchers at Cylance observed a hacking campaign that was delivering XMRIG Monero CPU miner by hiding them in WAV files.
4. PLATINUM hacker group, that usually targets Governments of South Asia and South East Asia, embedded their malware commands in the HTML code of a website. They achieved this by encoding malware commands in a specific sequence of “TAB” and “SPACE” bar.

In future steganography is going to increase in cyber security.

Computer viruses are among the most widely recognized cybersecurity threats in the world. Even people with little technical knowledge have heard the phrase, “My computer has a virus.” However, the term is often used to describe many different types of malicious software. In cybersecurity, a computer virus has a more specific meaning.

A virus is a type of malicious software, commonly called malware that attaches itself to a legitimate file or program and can spread when that infected file is executed or shared. Understanding computer viruses is important for anyone learning cybersecurity. Viruses help beginners understand how malicious software can affect files, applications, operating systems and users.

This guide explains what computer viruses are, how they spread, the different types of viruses, common warning signs, and how users and organizations can protect themselves.

What Is a Computer Virus?

A computer virus is a type of malware designed to replicate by attaching itself to another file, program or document. The virus generally requires some form of execution to become active. For example, an infected file may need to be opened or a compromised program may need to be run. Once active, the virus may attempt to copy itself to other files or systems.

Depending on its design, a computer virus may:

• Modify or corrupt files
• Disrupt normal system operations
• Delete or alter data
• Spread to additional files
• Cause applications to behave unexpectedly
• Create security risks for the affected system

Not every malicious program is technically a virus. For example, worms, Trojans, ransomware, spyware and rootkits are different categories of malware. However, in everyday conversation, people often use the word virus to describe almost any malware infection.

For cybersecurity beginners, understanding this difference is useful because malware categories often spread and behave in different ways.

How Does a Computer Virus Spread?

A virus needs a way to reach a new system and a way to become active. Historically, viruses commonly spread through infected floppy disks and removable media. Today, infections can occur through a variety of digital channels.

Infected Files and Software:

A virus may be attached to an executable program or another file. If a user downloads the file from an untrusted source and runs it, the malicious code may become active. This is why downloading software from official and trusted sources is important.

Email Attachments:

Email attachments can be used to distribute malicious files. An attacker may attempt to disguise a malicious attachment as:

• An invoice
• A document
• A software installer
• A report
• An image or archive

Unexpected attachments should always be treated carefully, especially if the sender or context seems unusual.

Removable Storage Devices:

USB drives and other removable storage devices can potentially transfer infected files between systems. If an infected file is copied and executed on another computer, the infection may spread. Organizations may use endpoint security controls and device policies to reduce this risk.

Compromised Downloads:

Attackers may distribute malicious software through websites or download sources that appear legitimate. Modified versions of popular software can sometimes contain hidden malicious components. Using official download sources reduces this risk.

Common Types of Computer Viruses

Computer viruses can be categorized according to how they behave and where they attempt to attach themselves.

File-Infector Viruses:

A file-infector virus attaches itself to executable files. When the infected program runs, the malicious code may also execute. The virus may then attempt to infect other compatible files on the system.

Macro Viruses:

Macro viruses are associated with documents that contain macros. Macros can automate tasks inside certain document applications. A malicious macro may attempt to perform unauthorized actions when the document is opened or when macros are enabled. This is why modern office security tools often warn users about macros from untrusted sources.

Boot Sector Viruses:

Boot sector viruses target areas involved in the computer startup process. Historically, these viruses were associated with infected removable storage devices. Although modern systems use different technologies and security protections, boot-related malware remains an important concept when studying the history of cybersecurity threats.

Polymorphic Viruses:

Some viruses are designed to modify aspects of their code as they replicate. The goal is often to make simple detection methods more difficult. For beginners, the important lesson is that malware authors may attempt to change how malicious code appears while preserving its harmful behavior.

Resident Viruses:

A resident virus can remain active in system memory after execution. This may allow it to monitor certain system activities and potentially infect files when they are accessed. Understanding this concept helps beginners recognize that malware does not always operate only when a single infected file is open.

What Happens When a Computer Gets a Virus?

The impact of a virus depends on its design. Some viruses may cause noticeable problems, while others may attempt to remain hidden.

Possible effects include:

• Slow system performance
• Application crashes
• Modified files
• Deleted data
• Unexpected system behavior
• Increased network activity
• Security software alerts

Some malware infections may also create additional security risks by weakening system protections or allowing other malicious activity. A system problem does not automatically mean that a virus is responsible.

Hardware failures, software bugs, outdated drivers and configuration problems can produce similar symptoms. Proper investigation is necessary to determine the actual cause.

Common Warning Signs of a Virus

Certain unusual behaviors may indicate that a computer should be checked.

Possible warning signs include,

Unexpected System Slowdowns:

A system may become noticeably slower due to abnormal processes or resource usage.

Unknown Programs:

Applications appearing without the user’s knowledge may require investigation.

Frequent Crashes:

Unexpected crashes or repeated application failures can sometimes indicate a software or security problem.

Unexpected Pop-Ups:

Unusual advertisements or browser activity may indicate unwanted or malicious software.

Changed Files or Settings:

Unexpected modifications to files, browser settings or system configurations should be investigated.

Security Alerts:

Security software may detect suspicious files or unusual activity.

These warning signs are not proof of a virus but they are good reasons to investigate further.

Computer Viruses vs Other Malware

One of the most important things for beginners to understand is that a virus is only one type of malware.

Virus

Typically attaches to another file or program and spreads through execution.

Worm

Can spread across systems or networks more independently.

Trojan:

Attempts to appear legitimate while hiding malicious functionality.

Ransomware

Restricts access to data or systems, often through encryption or other disruption.

Spyware

Collects information about users or systems without appropriate authorization.

Understanding these differences helps cybersecurity learners use more accurate terminology.

How to Protect Your Computer From Viruses

There is no single security tool that can eliminate every risk. Good cybersecurity relies on multiple layers of protection.

Keep Software Updated

Operating system and application updates often contain security fixes. Keeping software updated can reduce exposure to known vulnerabilities.

Download Software From Trusted Sources

Whenever possible, download applications from official websites or reputable sources. Be cautious of modified, unofficial or suspicious software downloads.

Be Careful With Attachments

Unexpected attachments should be verified before opening. Pay attention to unusual file types and messages that attempt to create urgency.

Use Security Software

Antivirus and endpoint security tools can help detect known malicious files and suspicious activity. However, security software should be considered one layer of protection rather than a complete solution.

Maintain Regular Backups

Regular backups can reduce the impact of data loss. Important backups should be protected from unauthorized modification and tested periodically.

Use Strong Account Security

Strong passwords and multi-factor authentication help protect online accounts. Although authentication controls do not directly prevent every virus infection, they can reduce the risk of unauthorized access to accounts and systems.

How Organizations Defend Against Computer Viruses

Organizations typically use several security layers.

These may include:

• Endpoint protection
• Email filtering
• Firewalls
• Network monitoring
• Security updates
• Access controls
• Security awareness training
• Backup systems
• Incident response procedures

This layered strategy is often called defense in depth. If one security control fails, other controls may still detect, contain or reduce the impact of malicious activity.

For example, an employee might receive a suspicious attachment. Email security may attempt to block it. If the attachment reaches the user’s computer, endpoint protection may detect it. Network monitoring may identify unusual activity if the malicious program becomes active.

Multiple layers improve an organization’s overall security posture.

What Should You Do If You Suspect a Virus?

If you suspect your computer may be infected, avoid taking actions that could make the situation worse.

A sensible approach may include:

1. Stop opening suspicious files.
2. Disconnect the device from networks if there is a serious risk of active malicious activity.
3. Run an approved security scan.
4. Follow guidance from your organization’s IT or security team if the device belongs to an employer or school.
5. Preserve important information when appropriate.
6. Restore systems or files from trusted backups when necessary.

For serious infections, professional technical assistance may be required.

Learning About Computer Viruses Safely

Beginners interested in malware should focus on understanding viruses through safe and legal educational resources.

Useful topics include:

• Operating system processes
• File systems
• Malware detection
• Threat intelligence
• Endpoint security
• Incident response
• Digital forensics

Avoid downloading or executing live malware simply to see how it works. Cybersecurity concepts can be studied using simulations, training labs, defensive tools, and controlled educational environments. The goal of learning about computer viruses should be to understand threats and improve defenses.

Conclusion

Computer viruses are one of the oldest and most recognizable forms of malicious software. Although cybersecurity technology has changed significantly over time, the basic lessons remain relevant.

Users should understand the risks of untrusted files, suspicious attachments, outdated software, and unsafe downloads. For cybersecurity beginners, learning about viruses also provides a useful introduction to the larger world of malware. Start by understanding what a virus is and how it differs from other types of malicious software.

Then learn how infections are detected, how systems are protected, and how organizations respond to security incidents. A strong understanding of computer viruses creates a useful foundation for future topics such as malware analysis, endpoint security, threat detection, digital forensics, and incident response.

What is a VIRUS?

Virus stands for Vital Information Resources Under Seize (VIRUS). Once a computer virus infects any system it tries to seize is resources. Like it’s pathological name sake, a virus attaches itself to an executable or program to propagate or infect computers. VIRUS always requires human action or interaction to infect systems. Let’s now study about different types of Virus and what resources they affect.

Types of Computer VIRUS

1. Browser Hijacker:

Have you ever opened your browser and noticed that all of its settings have changed? These settings include but not restricted to the URL of the home page, favorites and even the default search engine. Well, this is the case of a Browser Hijacker. It is called so because it simply hijacks your browser to alter its settings and also redirect to a phishing site or to display advance.

Browser hijackers are used by hackers to earn some good amount of money. For example, a browser hijacker named CoolWebSearch infected victim’s browsers and redirected the homepage and search results to the links the hackers wanted. Every time a victim clicked on these links, the hacker was paid money.

2. Web scripting virus:

A web scripting is a virus that exploits vulnerabilities in browser to infect web pages or websites and inject malicious code. This virus is useful to send spam or for stealing cookies.

3. File Infector virus:

One of the most common viruses, file infector virus infects files and copies itself into other executable programs such as .COM and EXE files. Some file infecting viruses infect critical system files too thus affecting the operating system.

4. Macro virus:

Macro virus is a virus that is written in the language of Microsoft Office macros or Excel Macros. They are embedded into a Word document on Excel file

5. Direct Action virus:

Also known as Non-resident virus, this type of virus directly connects itself to executables like EXE and COM file. This virus is also known as Non-resident Virus as it doesn’t install itself on the target system. Direct Action Virus becomes active only when the victim executes the file.

6. Resident virus:

Resident virus install itself in the memory to the system and then from there, infects other files while they are opened by the users.

7. Boot Sector virus:

This type of virus infects the Master Boot Sector of the hard disk or a USB drive. Master Boots Record (MBR) is the boot sector that is located at the very beginning of partition table. It contains information about operating system’s location and how it can be booted. Once this section is infected, the infected system will face bootup problems etc.

8. Multipartite virus:

A virus that uses multiple methods to infect the target system is known as multipartite virus.

9. Polymorphic virus:

A polymorphic virus or metamorphic virus is a virus that constantly changes its appearance or signature files to avoid detection.