What is malware?

Malware is software intentionally built to damage, disrupt, or gain unauthorized access to a device, network, or the data it holds. The term covers ransomware, spyware, trojans, worms, rootkits, and many other families. They all share the same trait: the code does something the system owner never agreed to. For a security team, the practical questions are how malware gets in, what it does once it's there, and how a SOC catches it before it reaches critical systems. This page covers the main categories, how infections happen, and what detection and response look like inside an organization.

Key takeaways

Malware is an umbrella term for software designed to harm, disrupt, or gain unauthorized access to systems and data.
Ransomware, spyware, trojans, worms, and rootkits are common categories, each with a different objective and method of spread.
Most infections start with a person, not a pure technical exploit. Common entry points include a phishing email, a fake update, or a malicious download.
Signature-based antivirus catches known threats but often misses fileless malware, polymorphic code, and living-off-the-land techniques.
Detection and response matter as much as prevention. EDR, XDR, and SIEM telemetry help a SOC catch malware that has already passed the perimeter.

How does malware get onto a device or network?

Most malware infections begin with a person taking an action, not with a threat actor breaking a technical control. An employee opens an attachment in a phishing email, downloads a cracked copy of paid software, or installs what appears to be a routine update. The malicious code arrives with something the user believes is legitimate.

Some infections need no user interaction. Worms spread by exploiting a vulnerability directly over a network connection. Compromised or malicious websites can trigger a drive-by download as soon as a page loads, using an exploit kit to check the visitor's browser and plugins for known weaknesses. Malicious ads served through legitimate ad networks, known as malvertising, work in a similar way.

Another route runs through the software supply chain. Threat actors compromise a vendor's build process or update mechanism, so the malicious code arrives bundled inside software the organization already trusts and has approved. Removable media, especially infected USB drives, remains an infection path for air-gapped or lightly monitored environments.

Whatever the entry point, the pattern is consistent. Threat actors look for the path of least resistance, whether that's an unpatched system, an untrained employee, or a trusted vendor relationship.

Types of malware

Malware families overlap in practice more than a clean taxonomy suggests. A single intrusion might start with a trojan, deploy a rootkit to hide, and finish by dropping ransomware. The table below breaks down the categories by their primary objective and typical behavior.

Types of malware
Type	What it does	Distinguishing trait
Virus	Attaches itself to a legitimate file or program and replicates when that file is opened or shared.	Requires a human action to activate and spreads through infected files.
Worm	Self-replicates and spreads across a network without needing a host file or user interaction.	Exploits a vulnerability directly and can spread network-wide within hours.
Trojan	Disguises itself as legitimate software to trick a user into installing it.	Does not self-replicate and is often used to deliver a second-stage payload.
Ransomware	Encrypts files or locks a device, then demands payment to restore access.	Displays a ransom note or on-screen demand and frequently follows a trojan or phishing intrusion.
Spyware	Monitors activity and exfiltrates data such as credentials, browsing habits, and keystrokes without consent.	Runs silently in the background and is often bundled with other software.
Adware	Displays unwanted advertisements and may track browsing activity to target them.	Isn't always malicious on its own, but is frequently bundled with more serious threats.
Rootkit	Modifies the operating system to hide its own presence and that of other malware.	Grants elevated privileges to a threat actor and is designed to persist undetected.
Keylogger	Records keystrokes to capture passwords, card numbers, and other sensitive input.	Is a specialized form of spyware, often deployed as part of a broader toolkit.
Cryptojacking malware	Hijacks a device's processing power to mine cryptocurrency for a threat actor.	Causes noticeable slowdowns, overheating, and higher power consumption without a ransom demand.
Botnet malware	Enrolls infected devices into a network of remotely controlled machines.	Is used for large-scale spam, DDoS attacks, or distributed credential stuffing.
Fileless malware	Operates in memory and abuses legitimate system tools instead of dropping files to disk.	Evades traditional signature-based antivirus and disappears on reboot.
Scareware	Displays fake security alerts to pressure a user into paying for bogus software.	Relies on social engineering rather than a genuine technical compromise.

Signs of a malware infection

None of the signs below confirms an infection on its own, but several appearing together are a strong reason to investigate.

A device runs noticeably slower than usual, or its fans run at full speed with no obvious cause.
Pop-ups, browser redirects, or new toolbars appear without the user installing anything.
Unfamiliar processes or startup programs appear in the task list.
Outbound network traffic spikes, especially to destinations the device has no reason to contact.
Security software is disabled, crashes repeatedly, or can't be reopened.
Files become encrypted, renamed, or disappear without user action.
Accounts show logins or actions the user doesn't recognize.

Why perimeter tools alone miss modern malware

Traditional antivirus matches files against a database of known signatures. That approach still catches many commodity threats, but it struggles with techniques that are now common in real intrusions. Polymorphic code changes its structure with each infection. Fileless techniques never write a file to disk. Living-off-the-land binaries use tools already present on the system, such as PowerShell, WMI, or scheduled tasks, instead of dropping custom malware.

The rise of malware-as-a-service has widened the pool of threat actors who can use these techniques. Ready-made malware kits, control panels, and support are rented on criminal marketplaces. A threat actor no longer needs to write code to launch a working campaign, which creates a steady supply of variants that a signature list won't contain.

Detection therefore depends on correlating signals across endpoint, network, identity, and cloud telemetry instead of trusting one control in isolation. An EDR agent might miss a fileless technique on its own, but the same activity can stand out when correlated with unusual authentication patterns or outbound connections in a SIEM. This is where the Sekoia SOC platform operates, bringing XDR, SIEM, and CTI telemetry together so that behavior an isolated endpoint tool might miss gets surfaced and investigated.

How a SOC detects and responds to malware

Detection happens in layers. Endpoint detection and response, or EDR, watches process behavior on individual devices. Network detection looks for command-and-control activity and unusual data flows. A SIEM correlates both with identity and cloud logs to catch activity that no single source would flag as suspicious. Threat intelligence adds context through known malware families, associated infrastructure, and the tactics of the groups behind them, helping analysts triage alerts faster and with more confidence.

Threat hunting fills the gap that automated detection leaves open. Analysts proactively search for behavior that resembles known threat actor techniques, mapped to frameworks such as MITRE ATT&CK, even when no alert has fired. Some intrusions will always evade automated rules for a period of time.

Once malware is confirmed, response follows a consistent sequence. Analysts isolate the affected system to stop lateral movement, contain the scope of the intrusion, eradicate the malware and any persistence mechanisms it installed, restore affected systems from clean backups, and run a post-incident review to close the gap that allowed the initial access.

Sekoia's TDR team runs this cycle for customers using the Sekoia SOC platform. It combines EDR, SIEM, and CTI data so detection, investigation, and response work from one correlated view rather than across disconnected tools.

How to reduce the risk of a malware infection

Keep operating systems, browsers, and third-party software patched on a defined schedule rather than an ad hoc one.
Apply least-privilege access so a compromised account or endpoint can't reach systems it has no reason to touch.
Filter email for malicious attachments and links, and train employees to recognize phishing attempts.
Deploy endpoint detection and response instead of relying on signature-based antivirus alone.
Maintain offline or immutable backups that ransomware and disk-wiping malware can't reach or encrypt.
Segment networks so a single infected device can't reach the entire environment.
Run regular threat hunting exercises instead of waiting only for automated alerts.

Why malware detection matters more than malware prevention

Prevention controls reduce the number of successful intrusions, but none stops every infection. Patch management, email filtering, and endpoint protection can all fail, and threat actors need only one gap. Organizations that limit damage assume some malware will get through and invest just as heavily in detecting it quickly once it does.

That means collecting endpoint, network, identity, and cloud telemetry together. It also means having analysts actively hunt for activity that automated rules miss, instead of relying on a dashboard that stays quiet until the incident has already spread.

Malware FAQ

What is the difference between a virus and malware?

Malware is the umbrella term for malicious software. A virus is one specific type of malware. It attaches to a legitimate file and replicates when that file runs. Every virus is malware, but not every piece of malware is a virus. Worms, trojans, and ransomware spread and behave differently from viruses, even though they fall under the same broader category.

Can malware infect a fully patched system?

Yes. Patching closes known software vulnerabilities, but much of today's malware enters through social engineering rather than an unpatched flaw. Common examples include a convincing phishing email, a fake software update, or a trojanized download. A fully patched system still depends on the person using it and on the detection controls behind the patch level.

‍

What is fileless malware, and why is it harder to detect?

Fileless malware runs in a device's memory instead of writing a file to disk. It often abuses legitimate tools such as PowerShell or Windows Management Instrumentation, which are already installed and trusted. Because there's no file to scan and the activity disappears after a reboot, traditional signature-based antivirus has little to work with. Detection depends on watching process behavior rather than matching known file signatures.

Is ransomware a type of malware?

Yes. Ransomware is one of the most damaging categories of malware. It encrypts files or locks a device, then demands payment to restore access. It commonly arrives through a trojan, a phishing email, or a compromised remote access credential rather than spreading on its own. The same defenses that stop other malware types, including patching, email filtering, and endpoint detection, also reduce ransomware risk.

How long does it typically take to detect a malware infection?

It varies by organization and by how the malware behaves. Fileless and living-off-the-land techniques are designed to delay detection, sometimes for weeks, by avoiding the file-based signals on which older tools rely. Organizations that correlate endpoint, network, and identity telemetry through a SIEM, and run active threat hunting instead of waiting only for automated alerts, generally shorten that window.

Can antivirus software alone stop modern malware attacks?

Antivirus still blocks many commodity threats, but it isn't designed to catch fileless techniques, polymorphic code that changes its structure, or living-off-the-land activity that never drops a recognizable file. Organizations facing targeted or persistent threats generally need endpoint detection and response correlated with network and identity telemetry through a SIEM, rather than antivirus running in isolation.