Author: kanishka10

Malware is one of the most important concepts to understand when learning cybersecurity. Whether you are interested in ethical hacking, penetration testing, network security or defensive cybersecurity, you will eventually encounter the term malware.

Malware can affect personal computers, mobile devices, servers and even large enterprise networks. Understanding what malware is and how it works at a high level can help beginners recognize cyber threats and understand why security controls are important.

This beginner’s guide explains what malware is, the major types of malware, how malware can spread, warning signs of infection and basic ways individuals and organizations can reduce their risk.

What Is Malware?

Malware is short for malicious software. It is software designed to perform harmful, unwanted or unauthorized actions on a computer system, network or device. The exact behavior of malware can vary significantly. Some malicious programs are designed to steal information, while others may disrupt systems, spy on activity, damage data or give an attacker unauthorized access.

Malware is not one single type of threat. It is a broad category that includes several different forms of malicious software. Understanding these categories is an important first step for anyone learning cybersecurity.

Common Types of Malware

1. Viruses

A computer virus is malicious code that can attach itself to legitimate files or programs. Traditionally, viruses spread when an infected file is executed or shared with another system.

A virus may be capable of:

• Modifying files
• Disrupting applications
• Damaging data
• Spreading to other systems

Modern cybersecurity discussions often use the word “virus” casually to describe any type of malware, but technically, a virus is only one category of malicious software.

According to Discovery, the first virus is the Creeper program. It was created by Bob Thomas in 1971. It was actually designed as a security test to see if a self-replicating program will be successful. The function of Creeper was to just display a simple message on computer if infected.

The most popular (or should I say unpopular) virus should be ILOVEYOU virus. Released in 2000, ILOVEYOU infected over ten million Windows computers. It started spreading as an email message with subject line “I LOVE YOU” and contained an attachment with name “LOVE-LETTER-FOR-YOU.TXT.VBS. When the recipient clicked on this attachment, a Visual Basic script activated and over wrote files on the infected system. Then, it sent itself to all the email addresses in the Windows Address Book. It is estimated that the losses infected by this simple virus were at least $15 billion.

2. Worms

A worm is malware capable of spreading across systems or networks without necessarily requiring a user to manually performing an action (like sharing an infected file). Worms can become particularly dangerous because automated spreading can allow an infection to affect many systems quickly.

A worm may exploit weaknesses in:

• Network services
• Unpatched software
• Insecure configurations

This is one reason why regular patching and network security are important.

Morris worm is considered to be the first worm to spread over the internet. It was created by Robert Tappan Morris and it caused a loss of over $100,000 and $10,000,000. It infected over 2000 computers within 15 hours. Morris worm spread by exploiting vulnerabilities like holes in the debug mode of the Unix send mail program, a buffer overflow vulnerability in finger network service. Rexec and Rsh accounts with weak or no password at all.

The most unpopular worm should definitely be Stuxnet. Released in 2010 and accused of sabotaging nuclear program of Iran, Stuxnet was designed to target programmable logic controllers (PLCs).  These PLC’s allow automation of electromechanical process used by control machines and industrial processes (for example, gas centrifuge that are used to separate nuclear material). Stuxnet spread by exploiting 4 zero-day vulnerabilities in Siemens setup7 software installed on Windows systems. Stuxnet infected almost over 2,00,000 computers and destroyed at least 100 machines.

3. Trojans

A Trojan or Trojan horse, is malicious software that attempts to appear legitimate or harmless.

A user might believe they are downloading:

• A useful application
• A document
• A game
• A software update

But the file may contain malicious functionality. The important lesson is that software should be downloaded from trusted and verified sources whenever possible. The name Trojan is a reference to the Trojan horse (the large wooden horse) of Trojan war assumed by Trojans as gift given by Greeks to Troy. However, when the horse was let into the kingdom, Greek soldiers hiding inside the horse came out and ransacked Troy (you should watch Troy movie).

Just like viruses, Trojans also need victims to click on Trojan to be activated and most users fall victim to trojans thinking that they are genuine files. ANIMAL, a program released in 1975 is generally considered the world’s first Trojan. It fooled victims by presenting itself as a simple game of 20 questions. When user clicked on it, it copied itself to shared directories to be found by other victims.

According to me, the most dangerous Trojan was Zeus. Zeus is a banking Trojan used to steal banking information. It is spread by drive by downloads and phishing in 2003. It is estimated that Zeus infected over 74,000 FTP accounts.

4. Ransomware

Ransomware is malware designed to prevent normal access to data or systems, often by encrypting files. The attacker may then demand payment in exchange for restoring access. Ransomware incidents can affect individuals, businesses, hospitals, schools and other organizations.

The first known ransomware was AIDS Trojan. It’s payload hid the files on the victim’s hard drive and encrypted their names. The most dangerous & popular ransomware attack was WannaCry in 2017. WannaCry ransomware spread by exploiting EternalBlue vulnerability and it infected over 2,30,000 computers within one day.

Strong backups, security updates, access controls and user awareness can help reduce the impact of ransomware incidents.

5. Spyware

Spyware is designed to secretly collect information from a device or user. Depending on its capabilities, spyware may attempt to monitor:

• Browsing activity
• User behavior
• Device information
• Other sensitive information

The best protection includes using trusted software, keeping devices updated and paying attention to unusual behavior.

The most popular spyware seen recently should be Pegasus spyware. This spyware developed by Israeli cyber arms firm NSO Group installs not just covertly but remotely on mobile phones running IOS and Android and that too using a zero-click exploit (an exploit that doesn’t need any user action at all). Once installed on a device, Pegasus can read text messages, snoop on calls, collect credentials, track location of the device, access device’s cameras and microphone and harvest information from apps installed on the target device.

6. Adware

Adware displays unwanted advertising or modifies the user’s browsing experience. Not all ad-supported software is necessarily malware. The difference often depends on whether the software was installed with informed user consent and how it behaves.

Malicious adware may:

• Display intrusive advertisements
• Redirect browsers
• Track user activity
• Change browser settings

7. Keyloggers

Keylogger is a malicious software that records keystrokes a user types into computer or mobiles. The first keylogger used in real world was allegedly distributed with Grand Theft Auto V mod in 2015. Recently, a keylogger named Snake keylogger was detected being distributed with Microsoft Excel sample. Snake keylogger first appeared in late 2020.

8. Backdoors

A backdoor is a type of malware that provides access to a system bypassing normal security measures that usually prevent access. For example, if you can access a system without providing any login or need of credentials, you have a Backdoor access. Usually, hackers install backdoor after gaining complete access to the system to have unhindered and continuous access in future.

In 1998, a U.S hacker group “Cult of the Dead cow” designed a backdoor named “Back Orifice” that enables a user to control a computer remotely. In 2014, multiple backdoors were detected in WordPress. These backdoors were WordPress plugins with an obfuscated JavaScript code.

9. Rootkits

A rootkit is designed to hide malicious activity or provide persistent unauthorized access. Rootkits can be particularly difficult to detect because their purpose may include concealing files, processes or other evidence of malicious activity.

It is designed to enable access to a computer in a way that is not usually possible to an authorized user. Simply put, Rootkit gives SYSTEM level access. As if this is not enough, Rootkit is undetectable once installed, unlike other types of malware. The term “Rootkit” is a combination of root (the most privileged account on Unix system and “kit”. This is because rootkits usually give ‘root’ level access to the target system.

The first malicious rootkit appeared in 1999 and it affected Windows NT OS.  In 2012, a rootkit named Flame was detected. Flame affected over 80 servers around the world and is considered one of the dangerous rootkits.

For beginners, the key concept is that some malware is designed not only to perform harmful actions but also to avoid detection.

10. Bots

A BOT is a shortcut for Robot and it is an automated piece of code that performs predefined tasks. Malicious Bots as normally used to infect a system and make them a part of a Botnet which can then be used to perform DDOS attacks.

In 2007, a botnet attack called Cutwail attacked Windows systems using a trojan named Pushdo which infected Windows systems to make them part of the Cutwail botnet. This botnet had over 1.5 to 2 million computers. The most famous BOT malware should be MIRAI. MIRAI is designed to infect smart devices that run on ARC processes.

11. Crypto Miner

Crypto mining malware or cryptojacker is a malicious software that targets computer sources and mines crypto currencies like Bitcoin. Cryptominers are rather new in the evolution of malware. Their growth directly grew with the growth in popularity of crypto currencies.

How Does Malware Spread?

Malware can reach systems through many different methods.

Phishing Emails

Attackers may send emails containing malicious attachments or links. These messages often attempt to create urgency or trick the recipient into taking action without thinking carefully.

Malicious Downloads

Downloading software, files or applications from untrusted sources can introduce malware. Fake software downloads and modified applications can appear legitimate.

Vulnerable Software

Outdated or unpatched software may contain known security weaknesses. Attackers may attempt to take advantage of these weaknesses to gain access to a system. This is why security updates are important.

Infected External Devices

Removable storage devices can potentially transfer malicious files between computers. Organizations often use security policies and endpoint controls to reduce this risk.

Compromised Websites

A legitimate website may sometimes become compromised and serve malicious content to visitors. Security software and updated browsers can help reduce exposure to known threats.

Common Signs of Malware Infection

Not every unusual computer problem is caused by malware but certain signs may indicate that a system should be investigated.

Possible warning signs include:

• Unusual system slowdowns
• Unexpected pop-ups
• Unknown applications appearing
• Browser settings changing unexpectedly
• Unusual network activity
• Security software being disabled
• Files becoming inaccessible
• Unexpected system crashes

These symptoms do not automatically prove that malware is present. However, they may indicate that further investigation is necessary.

How Malware Affects Organizations

For businesses, malware can create much more than a technical problem.

A serious malware incident can affect:

• Business operations
• Customer information
• Financial systems
• Employee productivity
• Company reputation

For this reason, organizations use multiple security controls rather than relying on a single antivirus product. A modern security strategy may include:

• Endpoint security
• Firewalls
• Network monitoring
• Security updates
• Access controls
• Data backups
• Email filtering
• Security awareness training
• Incident response planning

This approach is often described as defense in depth.

How Beginners Can Protect Against Malware

You do not need to be a cybersecurity expert to follow good security practices.

Keep Software Updated

Install security updates for operating systems, browsers and applications. Updates often fix known security weaknesses.

Download Software Carefully

Use official or trusted sources whenever possible. Avoid downloading suspicious files from unknown websites.

Be Careful With Email Attachments

Unexpected attachments and links should be treated carefully. Verify unusual messages before interacting with them.

Use Security Software

Endpoint protection and other security tools can help identify known malicious activity. However, no security product is perfect. Safe user behavior remains important.

Create Backups

Regular backups can reduce the impact of data loss and ransomware incidents. Backups should be protected and periodically tested.

Use Strong Authentication

Strong passwords and multi-factor authentication can help reduce the risk of unauthorized account access.

Malware Analysis vs Malware Creation

Beginners interested in cybersecurity may eventually hear about malware analysis. Malware analysis is the process of examining malicious software to understand its behavior and help improve defenses.

Security researchers and analysts may study malware to answer questions such as:

• What does it attempt to do?
• Which systems does it target?
• What indicators might help detect it?
• How can defenders reduce the risk?

This is very different from creating or distributing malware. For beginners, it is best to focus on safe analysis concepts, threat detection, prevention and defensive security.

A Beginner Learning Path for Malware

A structured learning path can make malware easier to understand.

Step 1: Learn Operating System Basics

Understand how Windows and Linux manage:

• Processes
• Files
• Users
• Permissions
• Services

Step 2: Learn Networking

Study:

• IP addresses
• DNS
• HTTP and HTTPS
• Ports
• Network traffic

Step 3: Learn Basic Security Concepts

Understand:

• Authentication
• Vulnerabilities
• Patching
• Access control
• Encryption

Step 4: Learn About Malware Types

Study viruses, worms, Trojans, ransomware, spyware, rootkits and other categories.

Step 5: Learn Detection Concepts

Explore how defenders use:

• Endpoint security
• Logs
• Network monitoring
• Threat intelligence
• Indicators of compromise

Step 6: Study Incident Response

Learn what organizations do when suspicious activity or malware is discovered.

Common Beginner Mistakes

Thinking Malware Is Always Obvious

Some malware may attempt to hide its presence. Security professionals often rely on multiple sources of evidence.

Believing Antivirus Solves Everything

Security software is important but it is only one layer of protection.

Downloading Security Tools From Untrusted Sources

Cybersecurity-related software should also be downloaded carefully from legitimate sources.

Ignoring Software Updates

Unpatched systems may remain exposed to known security problems.

Trying to Experiment With Real Malware

Beginners should avoid downloading or executing live malware.

Learning resources, simulations, defensive labs and controlled training environments are much safer ways to study malware concepts.

Conclusion

Malware is a broad category of malicious software that can affect individuals, businesses and critical systems. For beginners, the most important goal is not memorizing every malware family or technical term.

Instead, understand the fundamentals. Learn what malware is. Understand the major categories. Know how malware can spread. Recognize common warning signs. Learn basic prevention methods and understand how security professionals detect and respond to malicious activity.

As your cybersecurity knowledge grows, you can explore areas such as malware analysis, threat intelligence, endpoint security, digital forensics and incident response. A strong understanding of malware provides an excellent foundation for the defensive side of cybersecurity and helps you better understand the threats that ethical hackers and security professionals work to identify and prevent.

When learning cybersecurity, you will quickly encounter vulnerability reports containing numbers such as 5.3, 7.5 or 9.8. These numbers are designed to help security professionals understand how serious a vulnerability might be.

This process is known as vulnerability scoring. For beginners, vulnerability scoring can initially seem complicated. Terms such as CVE, CVSS, severity, exploitability and impact may appear together in security reports.

The good news is that the basic idea is simple. Vulnerability scoring helps security teams estimate the severity of a security weakness so they can prioritize which issues need attention first.

In this guide, we’ll explain vulnerability scoring in simple terms, introduce CVE and CVSS, explain severity levels and show how beginners can learn to interpret vulnerability scores.

What Is a Vulnerability?

Before understanding vulnerability scoring, you need to understand what a vulnerability is. A vulnerability is a weakness in software, hardware, configuratio on a system that could potentially be used to compromise security.

Vulnerabilities can exist in:

• Operating systems
• Web applications
• Network devices
• Databases
• Cloud services
• Desktop software
• Authentication systems

For example, outdated software might contain a publicly known security weakness. A vulnerability does not automatically mean that a system has been compromised. It simply means that a weakness exists that could potentially create security risk.

What Is Vulnerability Scoring?

Vulnerability scoring is a method of assigning a numerical or categorical rating to a security vulnerability based on characteristics such as its potential impact and exploitability. The purpose is prioritization.

Imagine a security team discovers 500 vulnerabilities across an organization’s infrastructure. It would be difficult to fix all 500 immediately. Instead, the team can use vulnerability scores and other contextual information to determine which issues deserve immediate attention.

What Is CVE?

One of the first terms beginners should understand is CVE. CVE stands for Common Vulnerabilities and Exposures. A CVE identifier provides a standardized reference for a publicly known cybersecurity vulnerability.

A CVE usually looks something like:

CVE-2026-XXXX

The identifier itself does not tell you how dangerous the vulnerability is. It provides a way for security professionals, vendors, researchers and security tools to refer to the same vulnerability consistently. Think of CVE as the identity of a vulnerability, rather than its severity score.

What Is CVSS?

The most widely recognized vulnerability scoring system is CVSS or the Common Vulnerability Scoring System. CVSS provides a standardized method for describing the severity of vulnerabilities.

Scores range from:

0.0 to 10.0

A higher score generally indicates greater severity. However, beginners should remember that a CVSS score is not the same thing as the actual risk to every organization. The importance of a vulnerability depends on the environment in which it exists.

Understanding CVSS Severity Levels

CVSS scores are commonly grouped into four major severity categories. They are,

None:

0.0

No severity is assigned.

Low:

0.1-3.9

The vulnerability generally has relatively limited security impact.

Medium:

4.0-6.9

The vulnerability presents a more significant security concern and may deserve attention depending on the affected system.

High:

7.0-8.9

The vulnerability can represent a serious security risk and generally deserves timely remediation.

Critical:

9.0–10.0

These vulnerabilities represent the highest severity category and often require urgent attention.

However, severity categories should be treated as a starting point rather than the final decision about what an organization should fix first.

What Factors Influence Vulnerability Scores?

CVSS considers several characteristics of a vulnerability. Beginners don’t need to memorize every metric immediately but understanding the major concepts is useful.

Attack Vector:

This describes how an attacker would reach the vulnerable component. For example, a vulnerability that can be exploited remotely across a network may present different characteristics from one requiring local access.

Attack Complexity:

This considers how difficult exploitation may be. A vulnerability requiring complicated conditions may receive a different assessment from one that can be exploited under relatively straightforward conditions.

Privileges Required:

Some vulnerabilities require an attacker to already have an account or certain permissions. Others may not require authentication or existing privileges.

User Interaction:

Some vulnerabilities require a victim to perform an action. Others can potentially be exploited without user interaction.

Confidentiality Impact:

This considers the potential effect on the confidentiality of information. For example, could exploitation allow unauthorized access to sensitive data?

Integrity Impact:

This considers whether exploitation could allow unauthorized modification of information or systems.

Availability Impact:

This considers whether exploitation could affect the availability of a system or service. For example, could it cause a service to become unavailable?

Why a High Score Doesn’t Always Mean “Fix This First”

This is one of the most important lessons for beginners.

Suppose a vulnerability has a CVSS score of 9.8. That sounds extremely serious. But imagine the vulnerable system is an isolated laboratory server with no sensitive data and no connection to important business systems. Now consider another vulnerability with a score of 7.5 affecting an Internet-facing server responsible for an organization’s most important application.

The second vulnerability could deserve immediate attention despite having a lower CVSS score. This is why security teams consider business context, exposure, asset importance and existing controls alongside vulnerability scores.

CVSS vs Real-World Risk

Think of CVSS as a standardized measurement of vulnerability severity. Risk is broader.

Organizations may consider the following things while fixing a vulnerability:

• Is the system Internet-facing?
• Does it contain sensitive information?
• Is the vulnerable service business-critical?
• Is exploitation occurring in the wild?
• Is a working exploit publicly available?
• Are compensating security controls present?
• How difficult is remediation?

This additional context helps security teams prioritize vulnerabilities more effectively.

Vulnerability Scoring During Security Assessments

Vulnerability scanners can identify potential security weaknesses and often include severity ratings.

A typical assessment workflow might look like:

Discover → Scan → Identify → Score → Prioritize → Remediate → Verify

The scanner may identify a vulnerability and associate it with a CVE and CVSS score. The security professional then investigates the finding and determines its relevance to the environment. This human analysis is extremely important.

False Positives

Automated vulnerability scanners aren’t perfect. A scanner might report a vulnerability that doesn’t actually exist because of:

• Incorrect version detection
• Configuration differences
• Missing information
• Environmental factors

This is called a false positive. Security professionals should validate important findings before making major decisions.

Vulnerability Prioritization

Once vulnerabilities have been identified and scored, security teams need to decide what to fix first. A simple prioritization model might consider the following things:

1. Severity:

How serious is the vulnerability according to the scoring system?

2. Exposure:

Can the affected system be reached from the Internet or an untrusted network?

3. Asset Importance:

How important is the affected system to the organization?

4. Exploitation Activity:

Is the vulnerability actively being exploited?

5. Remediation Availability:

Is a patch or mitigation available?

Combining these factors produces a much more useful risk picture than looking at the CVSS score alone.

Common Beginner Mistakes

Treating CVSS as a Complete Risk Rating:

A CVSS score provides valuable information but it doesn’t understand your organization’s business context.

Assuming 9.8 Means Automatic Compromise:

A critical vulnerability may still require specific conditions before exploitation is possible.

Ignoring Medium-Severity Vulnerabilities:

A medium-severity vulnerability on an important exposed system can still create significant risk.

Trusting Scanner Results Blindly:

Always investigate and validate important findings.

Focusing Only on Numbers:

Security is about understanding systems, not just reading scores.

How Beginners Can Practice Vulnerability Scoring

You don’t need access to a corporate environment to learn these concepts.

Create a safe cybersecurity lab using:

• Virtual machines
• Deliberately vulnerable systems
• Vulnerable web applications
• Vulnerability assessment tools

Study publicly documented vulnerabilities and compare:

• CVE identifiers
• CVSS scores
• Severity ratings
• Attack characteristics
• Potential impact
• Recommended remediation

The goal is to learn why a vulnerability receives a particular rating rather than simply memorizing scores.

A Simple Learning Path

If you’re new to vulnerability scoring, follow this progression:

Step 1: Learn what vulnerabilities are.

Step 2: Understand CVE identifiers.

Step 3: Learn the purpose of CVSS.

Step 4: Understand severity categories.

Step 5: Study CVSS metrics.

Step 6: Learn about false positives.

Step 7: Practice interpreting vulnerability reports.

Step 8: Learn how organizations prioritize vulnerabilities using business context.

This foundation will make vulnerability scanners and security reports much easier to understand.

Conclusion

Vulnerability scoring is an essential skill for anyone learning cybersecurity. It helps security teams organize large numbers of vulnerabilities and determine which weaknesses deserve closer attention.

For beginners, remember the difference between the major concepts:

CVE identifies a vulnerability.

CVSS helps describe its severity.

Risk considers the vulnerability within a real-world environment.

The most important lesson is not to become obsessed with the number attached to a vulnerability.

Instead, learn to ask better questions:

What is vulnerable? How can the vulnerability be reached? What could happen if it were exploited? How important is the affected system? Is the vulnerability being actively exploited? How can it be fixed?

Once you can answer those questions, vulnerability scoring becomes much more than a number. It becomes a practical tool for understanding, prioritizing and reducing cybersecurity risk.