Also known as: malicious software · trojan · worm · rootkit
Malware is any software written to cause harm to a system, network, or user, including viruses, worms, trojans, rootkits, spyware, and ransomware.
Categories describe propagation and behaviour rather than fixed types. A worm spreads without user interaction, a trojan disguises itself as legitimate software, a rootkit conceals its presence at a deep system level — and a single modern sample commonly exhibits several of these characteristics.
Detection has shifted from signature matching, which fails against trivially recompiled samples, toward behavioural analysis and reputation. Fileless malware, which operates entirely in memory using legitimate system tools, exists specifically to evade file-based inspection.
Ransomware
Ransomware is malicious software that denies an organisation access to its own data — historically by encrypting it — and demands payment in exchange for restoring access or withholding publication of stolen data.
EDR
EDR (Endpoint Detection and Response) is security software installed on endpoints that continuously records process, file, and network activity, detects suspicious behaviour, and enables remote investigation and containment.
Indicator of Compromise
An indicator of compromise (IOC) is an observable artifact — such as a file hash, IP address, domain, or registry key — that suggests a system may have been breached.
Exploit
An exploit is code or a technique that takes advantage of a specific vulnerability to cause unintended behaviour, such as executing attacker-supplied code, bypassing authentication, or crashing a service.
Supply Chain Attack
A supply chain attack compromises an organisation indirectly by targeting a trusted supplier, dependency, or software update mechanism, so that malicious code arrives through a channel the victim already trusts.