L6. Malware: Ransomware, Trojans, Rootkits & Spyware
Course outlineLesson 6 of 20
Malware is the attacker's primary weapon for compromising endpoints. The Security+ exam tests your ability to identify malware types, understand how they operate, and select appropriate defenses.
Malware Type Comparison
| Type | Spread | Key Behavior |
|---|---|---|
| Virus | Requires user action (execute infected file) | Attaches to legitimate files |
| Worm | Self-replicates across networks | No user action needed |
| Trojan | Social engineering | Disguised as legitimate software; creates backdoor |
| Ransomware | Phishing, RDP exploit, worm | Encrypts files; demands payment |
| Rootkit | Delivered via exploit/dropper | Hides attacker presence at OS or kernel level |
| Spyware | Bundled software, drive-by | Monitors user activity; exfiltrates data |
| Keylogger | Often bundled with other malware | Captures keystrokes |
| RAT | Phishing, exploits | Remote Access Trojan; persistent backdoor |
Ransomware: Modern Tactics
Modern ransomware operations use double extortion: attackers first exfiltrate sensitive data, then encrypt the victim's files. If the victim restores from backup, the attacker still threatens to publish the stolen data.
Triple extortion adds a DDoS attack on the victim's public-facing infrastructure.
Key ransomware delivery methods: phishing email attachments, exposed RDP (port 3389), unpatched vulnerabilities, and supply chain compromise.
Rootkits
Rootkits hide the presence of malware or an attacker on a system. User-mode rootkits: operate in user space; easier to detect and remove. Kernel-mode rootkits: operate at the same privilege level as the OS; can intercept and modify OS calls; very difficult to detect from within the running OS. Bootkits: infect the MBR or UEFI firmware; execute before the OS loads; survive OS reinstallation.
Defenses
- Anti-malware with behavioral detection (not just signatures)
- Application allowlisting (AppLocker, WDAC) to block unauthorized executables
- Network segmentation to limit ransomware lateral movement
- Offline, tested backups (3-2-1 rule: 3 copies, 2 media types, 1 offsite)
- Disable RDP if not needed; use MFA and VPN if required
- ✓Worms self-replicate without user interaction; viruses require execution of an infected file to spread
- ✓Ransomware double extortion: attackers exfiltrate data AND encrypt it, threatening to publish if not paid
- ✓Kernel-mode rootkits are hardest to detect because they operate at the same privilege level as the OS
- ✓RATs (Remote Access Trojans) provide persistent backdoor remote control to the attacker
- ✓3-2-1 backup rule: 3 copies of data, 2 different media types, 1 offsite; test restores regularly
1. Which malware type does NOT require user interaction to spread across a network?
2. A ransomware gang steals 50GB of sensitive data before encrypting the victim's files. The victim restores from backup. The attackers then threaten to publish the stolen data. What tactic is this?
3. Which rootkit type is the most difficult to detect and remove?
Recommended: Pluralsight
Turn your CompTIA Security+ concepts into passing marks: Pluralsight adds structured study plans, practice exams, and hands-on scenario labs.