Malware and Ransomware Defence

Introduction

Malware is software designed to harm, spy or steal. Knowing how it behaves and how it arrives lets you stop most of it before it does any damage.

Types of malware

• Virus: attaches itself to files and spreads when they are shared or run.
• Worm: spreads by itself across networks, without needing a user to run it.
• Trojan: pretends to be something useful, such as a free tool, but carries a hidden payload.
• Spyware and keyloggers: secretly record activity and passwords.
• Ransomware: locks or encrypts your files and demands payment to unlock them.
• Botnets: networks of infected devices controlled to attack others.
• Cryptominers: secretly use your computer to mine cryptocurrency.

How malware arrives

• Phishing emails and messages with bad attachments or links
• Unofficial downloads, such as cracked software or fake apps
• Unpatched software with known flaws
• Infected websites and malicious ads
• USB drives and shared files
• Weak or stolen passwords on remote access services

How ransomware works

1. An attacker gets in, often through phishing, stolen remote login details or an unpatched system.
2. They explore the network and may steal data.
3. They encrypt files on many machines, then demand payment, often in cryptocurrency.
4. Some threaten to publish stolen data as well.

Paying the ransom does not guarantee you get your files back, and it funds more crime. Authorities generally advise against paying, and urge you to report the incident. A tested, offline or immutable backup is the best answer, because then you can restore without paying.

Layered defence

No single tool is enough. Combine layers:

1. Update everything quickly: operating system, browser, apps and devices.
2. Backups: follow the 3-2-1 rule, keep one copy offline, and test restores.
3. Least privilege: use standard accounts for daily work, and give admin rights only when needed.
4. Multi-factor authentication on email, remote access and admin accounts.
5. Endpoint protection: reputable antivirus or endpoint detection built into or added to your system.
6. Email and web filtering to block known bad links and attachments.
7. Network segmentation so an infection cannot reach everything.
8. Training and habits: question unexpected messages, and download only from official sources.
9. Disable macros and unneeded features in documents from unknown sources.

If you suspect an infection

1. Disconnect the device from the network (unplug the cable or turn off Wi-Fi), but do not switch it off if advised to preserve evidence at work.
2. Tell your IT or security team, or follow your organisation's plan. At home, ask a trusted professional.
3. Change passwords from a clean device.
4. Run a scan with trusted tools and restore from a clean backup if needed.
5. Report the incident where appropriate.

Try it yourself

Test your backup. Pick one important file, restore it from your backup, and open it. Note how long it took, and write one improvement you will make.

Summary

• Malware includes viruses, worms, trojans, spyware and ransomware, and mostly arrives through phishing, unsafe downloads and unpatched systems.
• Ransomware encrypts files for payment, and tested offline backups are the best protection.
• Use layers: updates, backups, least privilege, MFA, filtering and good habits.