What Is Malware? A Working Taxonomy
Malware — malicious software — is a family of programs written to harm, spy on, or take control of systems. It is not one thing but many, and the categories overlap: a single sample can be a trojan that installs a rootkit and deploys ransomware. Knowing the taxonomy helps you read advisories and reason about what a given threat can actually do.
How is malware classified?#
Two axes matter: how it spreads and what its payload does. By propagation and behavior:
| Type | Defining trait |
|---|---|
| Virus | Attaches to a host file; spreads when the host runs |
| Worm | Self-propagates across networks, no user needed |
| Trojan | Disguised as legitimate software to get run |
| Ransomware | Encrypts data and demands payment |
| Spyware | Secretly collects information |
| Rootkit | Hides itself and maintains stealthy access |
| Botnet client | Enlists the host into a remote-controlled network |
These describe different aspects — a real sample often wears several labels at once, which maps onto the vulnerability, exploit, and payload distinction: delivery and goal are separate things.
Why does the category matter for defense?#
Because different malware fails to different controls. Worms are stopped by patching and segmentation; trojans by user caution and application allowlisting; ransomware is survived by tested backups; spyware is caught by egress monitoring. Naming the type points you at the control that actually helps.
Malware is what most attacks ultimately deliver. See how it fits the Cyber Kill Chain and the rest of the Security Fundamentals hub.
Frequently asked questions#
What is the difference between a virus and a worm?
A virus attaches itself to a file or program and needs a user to run that host to spread. A worm is self-propagating: it spreads across networks on its own, exploiting vulnerabilities without any user action. That autonomy is why worms can spread globally in hours while viruses depend on people.
Is ransomware a type of malware?
Yes. Ransomware is malware whose payload encrypts or locks data and demands payment for its return. It is defined by its goal, not its delivery — the same ransomware might arrive as a trojan, through a worm, or via a phishing attachment. The category describes what it does once it runs.