Malware and Ransomware: How They Work

"Malware" sounds like something only experts can understand, yet the idea is simple: it is software that does something you never agreed to. In this lesson you will meet the main families of malicious software, see how they reach a device, and understand why ransomware has become such a serious problem for individuals, schools and businesses alike.

In the previous lesson we saw how a phishing message convinces you to act. Very often, the "action" it asks for is to open a file or install something. That is how malware enters the picture. Understanding what it does will make the protections in later chapters feel logical rather than arbitrary.

What is malware?

Malware (short for "malicious software") is any program designed to harm, spy on or take control of a device or its data. It is not a single thing. It is a large family with very different behaviors, like the way "pests" covers mice, mosquitoes and termites: all unwelcome, but each one requires a different response.

The main families

• Viruses and worms: programs that copy themselves. A virus needs a host file and a user action to spread; a worm can spread by itself across networks.
• Trojans: software that pretends to be something useful, such as a free game, a cracked program or a "PDF viewer", while secretly doing something else. The name comes from the wooden horse.
• Spyware and stalkerware: tools that quietly watch what you do, record keystrokes or access messages and location. Stalkerware is installed on someone's phone by a person close to them.
• Keyloggers: a kind of spyware that records what you type, including passwords.
• Remote access tools used maliciously: they let an attacker control your device as if they were sitting in front of it.
• Botnet agents: they turn your device into one of thousands of remote-controlled machines, used to send spam or flood websites with traffic. Often you notice nothing.
• Cryptominers: they use your processor to generate digital currency for someone else, slowing your device and increasing your electricity use.
• Adware: aggressive advertising software that injects pop-ups and changes browser settings.
• Ransomware: software that locks your files and demands payment. We will look at this one closely below.

How malware reaches you

Malware needs a way in. Over the years the same entrances come up again and again:

• Email attachments: documents, archives and "invoices" that carry hidden code or tempt you to enable macros or open a second file.
• Malicious links: pages that trigger a download or exploit an out-of-date browser.
• Unofficial downloads: cracked software, free versions of paid tools, fake updates, and modified apps from unofficial stores.
• Infected removable drives: USB sticks found or borrowed from others.
• Unpatched software: flaws in programs that the vendor has already fixed, but that you have not yet updated.
• Fake support pop-ups: alarming messages claiming your device is infected and urging you to install a "cleaner".
• Browser extensions and apps that seemed harmless when installed or that changed hands later.

Notice how many of these require your participation. That is good news: your habits are a real line of defense.

Ransomware in detail

Ransomware has a very straightforward business model. The attacker gets access to a device or a network, encrypts the files with a key only they hold, and then displays a message: pay to get the key back. "Encrypting" means scrambling data so that it is unreadable without the right key. The same technology that protects your online banking is turned against you.

A typical sequence looks like this:

1. Entry: a phishing email, a stolen password, or an unpatched system.
2. Preparation: the attacker explores, finds the valuable files and, often, the backups.
3. Encryption: documents, photos and databases become unreadable, sometimes within minutes.
4. Demand: a message asks for payment, often with a countdown to create pressure.
5. Extortion on top: many groups also copy the data beforehand and threaten to publish it, which is why even a good backup does not fully solve the problem for organizations.

Paying is strongly discouraged by authorities such as the French national agency cybermalveillance.gouv.fr. There is no guarantee that you will get your files back, it finances further attacks, and it can mark you as a target who pays. The best protection is made of three things: updates, careful habits, and tested backups. Backups get their own lesson in Chapter 3.

Common signs of infection

Malware tries to stay hidden, but some signs should raise your attention:

• The device becomes unusually slow, hot, or the fan runs constantly while you are doing nothing.
• Programs you did not install appear, or your browser's home page and search engine change by themselves.
• Files suddenly have strange extensions or cannot be opened.
• Security tools are disabled and you did not do it.
• Contacts report receiving messages from you that you never sent.

None of these is proof on its own, since a slow computer is often just an old computer. But several together deserve a closer look, and we will see what to do in Chapter 7.

Why attackers choose ordinary people

You may think nobody would bother to attack you. Attackers do not choose people individually: they send millions of messages and keep whoever responds. Your photos, your accounts and your computing power all have value to them. This is one of the most important mindset changes of the course, and we will build on it in lesson 4.

Your turn

Exercise. For each situation, name the most likely type of malware and the entry point.

1. A friend sends you a link to download a premium photo editor for free, "cracked".
2. All the files in a shared family folder have been renamed and a text file asks for payment.
3. Your laptop runs slowly all day and the fan never stops, though you only have a browser open.

See a solution

1. A trojan (possibly with a keylogger or spyware inside), entering through an unofficial download. A cracked program asks you to disable protections, which is a big warning sign in itself.
2. Ransomware. The likely entries are a phishing attachment, a stolen password for a network drive, or an unpatched system. The right reaction is to disconnect the device from the network and not pay.
3. Possibly a cryptominer or a botnet agent. It may also be a legitimate heavy program or an aging machine, so check the list of running processes and installed programs, and run a security scan.

Add to your Security Notebook

Under "1. Threats", write down the three entrances you consider most relevant for you (for example "email attachments", "free downloads", "old software") and one habit you will adopt for each.

Next, we leave the technical side and look at a threat that targets your wallet directly: online scams and financial fraud.