1.3Malware and malicious programs

When a CSIRT member responds to a device suspected of malware infection, the first step is to diagnose the malware type from the observed behavior (symptoms). A misdiagnosis leads to the wrong containment measure—if a device is spreading to other machines over the network, simply deleting a file will not stop the infection. This section covers malware types together with their characteristic behavior and the corresponding containment measure.

1.3.1Worms and bots

• A worm is malware that self-replicates on its own, without parasitizing another program, and spreads itself to other devices over the network. The key operational point is that isolating the infected device (cutting network access) is required to stop the spread.
• A bot is malware that puts an infected device under an external attacker's remote control. A botnet—many bot-infected devices—lets the attacker issue commands all at once via a C&C server (Command and Control server), commonly abused for DDoS attacks or spam distribution.
• Connect-back communication is a scheme in which a bot-infected device, from inside a corporate firewall, initiates the connection to the external C&C server itself. Firewalls typically restrict inbound (external-to-internal) connections tightly but tend to allow outbound (internal-to-external) traffic, and this asymmetry is exploited to evade detection.

1.3.2Ransomware, spyware, and keyloggers

• Ransomware encrypts files on an infected device or server and demands a ransom in exchange for decryption. It primarily breaches availability, and the core countermeasure is maintaining offline or immutable backups.
• Spyware collects personal information or behavioral data without the user's awareness and sends it externally. A keylogger is a type of spyware that records keystrokes, used to steal passwords or credit card numbers.

1.3.3Rootkits, backdoors, fileless malware, and mutating variants

• A rootkit is a toolset that an attacker who has seized administrator (root) privileges uses to hide evidence of the intrusion (processes, files, communications) at the OS level. Ordinary commands or tools often fail to reveal the intrusion, frequently requiring dedicated detection tools or a full OS reinstall.
• A backdoor is a hidden entry point an attacker plants to regain access without going through normal authentication. It is often planted alongside a malware infection, and if a backdoor remains after cleanup, re-entry is still possible, so the intrusion vector and any remaining backdoor must always be checked during remediation.
• Fileless malware does not save an executable to disk, operating only via the OS's built-in scripting features or in memory. File-scan-based antivirus struggles to detect it, and memory analysis or behavior-based detection is an effective countermeasure.
• A polymorphic variant changes its encryption or code appearance on each infection to evade signature (pattern) detection. A metamorphic variant goes further, rewriting the code structure itself while preserving functionality, so signature-based detection alone cannot keep up, requiring behavior-based or heuristic detection as well.

Suppose a CSIRT member observes the following behavior across several internal devices. (1) One device is repeatedly copying the same executable file to other devices over a file-sharing protocol, and the infection is spreading. (2) A different device periodically initiates communication to an unfamiliar external IP, with the connection always initiated from inside, never received from outside. (3) Yet another device shows a large number of files on a file-sharing server becoming encrypted and inaccessible around the same time. The CSIRT member first diagnoses the type from the behavior. (1), self-propagating spread to other devices, is diagnosed as a worm, and containment prioritizes network isolation (cutting off the affected segment). (2), the asymmetric pattern of internal-to-external outbound connections, is diagnosed as bot connect-back communication, leading to blocking the destination IP and preserving communication logs with the C&C server (to identify other infected devices). (3), the symptom of mass simultaneous encryption—an availability breach—is diagnosed as ransomware, prompting immediate disconnection of the file-sharing server from the network to stop further encryption, followed by a recovery plan from offline backups; paying the ransom is not recommended (there is no guarantee of decryption, and it also funds the attacker). If abnormal behavior continues on a device despite ordinary antivirus scans detecting nothing, the possibility of fileless malware or a polymorphic variant should be suspected, requiring the additional judgment to switch to memory analysis or behavior-detection tools. Narrowing down the malware type from the observed behavior pattern and then choosing the containment measure appropriate to that type is the core of practical response that prevents the damage from spreading.

1.3.4Section summary

• Worm = self-replicates and spreads on its own; bot = remotely controlled from a C&C server; connect-back communication = exploits the asymmetry of internally initiated outbound connections
• Ransomware encrypts and demands ransom (an availability breach). Recover via offline backups; payment is not recommended
• Rootkit = conceals intrusion traces; fileless malware = leaves no disk footprint, runs via memory/scripts; polymorphic/metamorphic malware evades signature detection