Malware, Ransomware & Trojan Threats
Malicious software represents a broad spectrum of hostile code engineered to compromise system integrity, exfiltrate confidential data, or disrupt network operations. Key classifications include self-replicating worms that propagate across network vulnerabilities without user intervention, Trojan horses disguised as legitimate software, and low-level rootkits that conceal persistence mechanisms within operating system kernels. Ransomware variants, such as WannaCry and LockBit, deploy asymmetric cryptographic algorithms like RSA-2048 and AES-256 to encrypt local storage drives before demanding cryptocurrency ransoms. Modern endpoint detection and response (EDR) platforms deploy heuristic behavior analysis, signature matching, and sandboxed execution environments to intercept malicious payloads before lateral movement occurs.
Key Concepts & Examination Highlights
- Worms propagate autonomously across network protocols without requiring host file attachment or human interaction.
- Ransomware commonly utilizes hybrid encryption (combining AES for symmetric payload speed and RSA for secure asymmetric key exchange).
- Rootkits alter kernel-level system calls to hide malicious processes and registry modifications from traditional antivirus scanners.
- Spyware and keyloggers covertly monitor keystrokes and capture sensitive data to transmit back to command-and-control servers.