8.2 Threats, Vulnerabilities & Malware

Before you memorize malware names, lock down three vocabulary words that appear throughout security and on aptitude-style cyber exams: vulnerability, threat, and risk. Misusing them loses easy points. Then learn the malware taxonomy — how each family spreads and what damage it typically does.

Vulnerability vs Threat vs Risk

Keep Them Straight

• Leaving Remote Desktop open to the internet with a weak password is a vulnerability (and a bad practice).
• A botnet that brute-forces RDP credentials is a threat (actor/capability).
• The chance that the botnet succeeds and encrypts the mission share, times the operational impact of that outage, is the risk.

You mitigate risk by reducing vulnerabilities (patch, harden), reducing threat exposure (segment, block, deter), or reducing impact (backups, failover). Saying “we patched the threat” is sloppy language — you patched the vulnerability or reduced the risk.

Mission Framing

A cyber defender assessing a base network asks: What weaknesses exist (vulnerabilities)? Who or what might exploit them (threats)? What happens to the mission if they succeed (impact → risk)? That same chain of reasoning appears in CT-style scenario questions.

---

What Malware Is

Malware (malicious software) is software intentionally designed to disrupt, damage, steal, or gain unauthorized control. Delivery methods include email attachments, malicious links, infected removable media, drive-by downloads, supply-chain compromised updates, and lateral movement after an initial foothold.

Malware is often discussed by propagation method (how it spreads) and payload (what it does once running). One sample can combine traits — for example, a worm that drops ransomware — but exam questions usually test the defining trait named in the stem.

---

Malware Taxonomy

Virus

A virus attaches to a host file or boot sector and typically needs human action (opening a file, running a program) or execution of the infected host to spread further. Classic viruses infect executables or documents with macros. They do not, by definition, self-propagate across networks without some host and trigger.

Recognition cue: “Attaches to files” / “spreads when infected programs run.”

Worm

A worm is standalone malware that self-propagates across networks or systems, often by exploiting remote vulnerabilities or weak credentials, without needing a host file in the virus sense. Worms can consume bandwidth, open backdoors, and drop secondary payloads at scale.

Recognition cue: “Spreads automatically over the network” / “no user click required after initial conditions.”

Trojan (Trojan Horse)

A trojan disguises itself as legitimate or desirable software. The user (or an automated installer) runs it willingly under false pretenses. Trojans do not self-replicate like worms; their power is deception plus whatever payload they carry (remote access, credential theft, downloader).

Recognition cue: “Looks like a useful app” / “user is tricked into installing.”

Ransomware

Ransomware encrypts or locks access to data or systems and demands payment (often cryptocurrency) for restoration. Impact is primarily availability (and often integrity of stored data). Modern ransomware frequently arrives via phishing, trojans, or post-exploitation after credential theft, then spreads laterally before detonating.

Recognition cue: “Files encrypted / locked until payment.”

Spyware

Spyware secretly collects information — keystrokes, screenshots, browsing, credentials, microphone/camera — and exfiltrates it. Primary impact is confidentiality. Some spyware is bundled with seemingly legitimate software; some is installed after another compromise.

Recognition cue: “Silently steals information / monitors activity.”

Rootkit

A rootkit is designed to hide malware or attacker presence by subverting the operating system, boot process, or sometimes firmware so that files, processes, and network connections do not appear in normal tools. Rootkits enable persistence and stealth for other payloads.

Recognition cue: “Conceals processes/files from the OS” / “hard to detect with standard tools.”

Quick Comparison Table

---

Exploitation Chain (How Pieces Fit)

1. Reconnaissance — threat actor finds exposed services or users.
2. Vulnerability — unpatched service, weak auth, or human trust.
3. Delivery — phishing email, exploit kit, infected USB, malicious update.
4. Installation / execution — trojan runs, worm spreads, virus infects hosts.
5. Actions on objectives — spyware steals, ransomware encrypts, rootkit hides C2.
6. Risk realized — mission data leaked, systems down, trust in telemetry broken.

Defenders interrupt the chain: patch and harden (shrink vulnerabilities), filter and authenticate (limit threat reach), detect and respond (cut impact), and back up offline (reduce ransomware impact).

---

CIA Mapping for Malware Outcomes

• Spyware exfiltrating clearance-related PII → Confidentiality
• Worm flooding links until sensors cannot report → Availability (and possibly integrity if it alters hosts)
• Rootkit hiding altered system binaries → Integrity of the system view plus concealment
• Ransomware locking the mission share → Availability (with integrity of encrypted data)

When a question gives both a malware type and an effect, answer with the effect’s CIA pillar if asked for impact, or the malware type if asked for classification.

---

Practical Hygiene (Still Testable)

• Keep systems patched; many worms succeed only on known vulnerabilities.
• Do not run untrusted executables — trojans depend on that mistake.
• Use least privilege so malware that runs has less to steal or encrypt.
• Maintain offline or immutable backups against ransomware.
• Monitor for unusual process hiding and integrity violations that suggest rootkits.

You do not need vendor brand names for the CT. You need clean definitions, clean distinctions among vulnerability/threat/risk, and the ability to classify malware by behavior.