Key takeaway
Check which resources a file or process touches and what connections it makes, rather than relying on its name. Isolate a suspected device under the response plan, investigate it from a trusted environment and verify recovery.
Malicious code: intent and possible impact
Malicious code is software, a script or a code fragment deliberately created for unauthorized access, data theft, disruption or surveillance; it differs from an accidental bug. A virus may spread with an infected file, a worm can replicate across a network, a Trojan may appear benign and a logic bomb may activate when a condition is met. An infostealer collects passwords and browser data; ransomware may encrypt files and threaten to publish stolen data; a wiper destroys information. Spyware may record screens or keystrokes. A botnet coordinates compromised devices, a backdoor preserves hidden access and cryptojacking uses someone else’s computing resources to mine cryptocurrency without permission.
A bootkit may load before the operating system
A bootkit may alter a boot-chain component and run before the operating system fully loads. On a legacy BIOS system, the target may be the MBR; on a UEFI system, investigators may check the EFI partition or firmware. TDL4 is an example associated with legacy MBR persistence, while LoJax targeted UEFI firmware; the placements differ. An ordinary in-OS scan may therefore be insufficient, but this does not mean every bootkit affects every system or necessarily survives an OS reinstall. Use a trusted offline scan, vendor updates and qualified support; do not reflash firmware by guesswork.
A botnet may use centralized or peer-to-peer control
A botnet is a network of compromised devices controlled remotely through malware. A centralized command-and-control server is simpler to manage, but disrupting that hub can affect the whole network; peer-to-peer devices pass information without one central point. Botnets may support DDoS, spam, data theft or financial fraud. Mirai’s use of IoT devices for DDoS and Zeus’s theft of banking credentials illustrate different goals. Unexpected outbound traffic, repeated connections to unfamiliar external addresses, high CPU use and unknown processes are signals to investigate.
A keylogger may capture input in software or hardware
A keylogger records keyboard input. Software versions may also collect screenshots or clipboard contents, storing or transmitting the data. Hardware versions may sit between the keyboard and computer or inside the keyboard; a software scan does not replace physical inspection. Review suspicious processes and outbound connections, and inspect ports and cables. If software or hardware is found, preserve evidence, notify security, change passwords from another trusted device and revoke affected sessions. Organizational keystroke monitoring requires separate review of authorization, transparency and applicable legal requirements.
Find the delivery path and contain the impact
Malicious code may arrive through a phishing attachment or link, fake software update, vulnerability, USB media, supplier update or advertising chain. Malvertising places a malicious ad on a legitimate site or ad network and may cause a redirect, fake warning or exploit attempt; not every ad or iframe is malicious. Restrict a suspected device’s network access under the response plan, preserve logs and involve the security team. Install updates from trusted sources, restrict unnecessary macros and privileges, apply email and web controls, segment the network and test recovery from backups.