Module 08 · Code that wants something from you

Malware

Software written to do something the owner of the computer would not consent to if asked. Six decades of the same problem dressed in different clothes: how does code get on the box, what does it do once it is there, and how does it stay. This module covers the families, the lifecycle, and the defensive stack — capped with a tabletop exercise where you make the calls during a ransomware incident.

7

Reference Pages

08

Module

1

Tabletop Lab

The historical trajectory of malware is not a story of attackers getting smarter, exactly — the techniques in WannaCry (2017) were already old in Code Red (2001). The story is one of monetization: once attackers worked out how to convert access to dollars at scale, every other piece of the lifecycle — delivery, persistence, lateral movement, exfiltration — got industrialized to feed the pipeline.

The rule that ties this module together: defenses must disrupt the chain, not catch the payload. Catching the binary signature was a 1990s sport. Modern defense is about breaking the kill chain at as many stages as possible so that no single defensive failure ends the game.

08.A

Reference Pages

Foundations & Taxonomy

What malware is, the three-axis taxonomy (intent + propagation + payload), and the parasitic family — spyware, adware, cryptojackers — covered briefly here. A framework for classifying any new sample you encounter.

Viruses & Worms

The propagating originals. Virus = host-dependent; worm = self-propagating. From Morris (1988) through ILOVEYOU, Code Red, Conficker, and the worm component of WannaCry that turned a ransomware family into a global outage.

Trojans, Droppers, Loaders

The deception family. The user runs them voluntarily. Modern multi-stage chains (Emotet → TrickBot → Ryuk) where each stage's only job is to fetch the next, defeating signature-based detection.

The killer app of the 2020s. Crypto-locker mechanics, RaaS economics, double extortion, the named incidents (Colonial Pipeline, JBS, Maersk/NotPetya, Change Healthcare, MGM). Interactive timeline of a typical attack.

Rootkits & Bootkits

Persistence and stealth at the lowest possible layer. User-mode vs kernel-mode rootkits, bootkits, UEFI implants (LoJax, MoonBounce, BlackLotus). The Sony BMG rootkit scandal that defined the category for the public.

Lockheed Martin's seven phases (Recon → Weaponization → Delivery → Exploitation → Installation → C2 → Actions on Objectives) plus MITRE ATT&CK as the modern, finer-grained alternative. Step through a real ransomware attack mapped to each phase.

EDR/XDR, application allowlisting, network segmentation, immutable backups (3-2-1-1-0), least privilege, patch cadence, security awareness. Mapped to which kill-chain stages each defense disrupts, with the trade-offs each one carries.

08.B

Hands-On Lab

Ransomware Tabletop Exercise

You are the IR commander. A ransomware note appears on the CFO's laptop at 4:17 AM. Walk the team through detection → containment → eradication → recovery → lessons-learned. Every choice branches; some choices lose the company a week and others lose it everything. Mapped to NIST SP 800-61.