Malware is malicious code that threat actors use to compromise data collected, stored, processed, or transmitted by mobile devices, computers, servers, or any other internet-connected device or application. As part of an organization’s security and data protection program, it should have a plan in place that, at minimum, mitigates risk to systems and networks arising from four common types of malicious software: trojans, spyware, viruses, and ransomware.
Named after the Greek story of the wooden horse used to infiltrate Troy, a trojan is a software that disguises itself as legitimate, tricking users into downloading it. When users click on the executable file (.exe), the program installs on the device, enabling attackers to use it to complete additional objectives, like:
Unlike other types of malware, trojans are not self-replicating, meaning that the user has to take action and actively click on the file for the malicious software, or payload, to execute. In addition, malicious actors often use social engineering tactics to convince users to engage in risky behavior. For example, trojans can infect mobile devices and smartphones, enabling threat actors to use them as part of a Distributed Denial of Service (DDoS) attack by controlling them as part of a botnet.
There are several ways trojans can be hidden:
While threat actors use trojans across all industries, attackers have increasingly targeted financial services over the last few years. Some examples of trojans seen between 2017 and 2021 include:
A device infected with a trojan may:
Spyware is the Jason Bourne of the malware world. When executed on a computer or mobile device, spyware gathers information about people or organizations by monitoring user activity and reporting back to the attacker. However, unlike other malware variants, spyware may not interrupt the device’s operations.
This malicious code focuses on violating the end user’s privacy and can compromise:
Traditionally distributed to computers using freeware or shareware, spyware can infect mobile devices via:
In addition to compromising data, mobile device spyware can also steal information like:
Beyond that, a mobile device spyware could also use:
Spyware can be classified as:
Some specific mobile spyware variants are:
Although some antivirus tools may be able to detect a spyware signature, this is not true for all types, especially mobile device spyware.
A device infected with spyware may:
Viruses are self-replicating malicious code that can infect other programs and spread across systems. While a trojan requires a user to take action that downloads and executes the malware, a virus inserts itself into an application. Like a parasite, the virus relies on the host application to propagate, execute, and reproduce only while the infected application is running. Once executed, data and files may be:
Attackers can use any of the following to spread the virus:
While any file is at risk, some are more likely to get infected, like:
A virus typically spreads when an infected software or document is transferred from one computer to another. Viruses can spread quickly across networks, file shares, or email attachments in internet-connected ecosystems.
Viruses can be categorized as:
A device infected with a virus may:
Ransomware is malware that encrypts files or devices, only decrypting them once the company makes the requested ransom payment. In recent years, these attacks have evolved to include “double extortion,” where malicious actors encrypt and exfiltrate sensitive data in an attempt to overcome risk mitigation strategies like data backups.
To spread ransomware, an attacker can use malicious:
Ransomware has become more prevalent due to the Ransomware-as-a-Service (RaaS) business model. Cybercriminals sell access to the malware by charging a subscription fee or a percentage of the ransom. Without having to create the code, less sophisticated actors can deploy a ransomware attack which means more people are able to engage in criminal activity.
Increasingly, threat actors target mobile device operating systems like iOS or Android. Mobile ransomware works slightly differently from traditional ransomware. Instead of encrypting the device, which can easily be restored from a cloud sync backup, these ransomware variants focus on locking access to the mobile device, preventing use.
Some famous ransomware variants include:
Security researchers have also detected mobile device ransomware variants like:
Even before attackers send a ransom request, a device infected with ransomware may experience:
While organizations may have anti-virus protection to protect traditional devices like laptops, attackers increasingly seek to exploit the inherent security and privacy risks of mobile devices to deploy attacks. In addition, mobile devices lack the crucial advanced security layer to protect against sophisticated attacks, leaving systems, networks, and sensitive data at risk.
Zimperium zIPS detects both known and unknown threats, including zero-day, phishing, and network attacks, by analyzing slight deviations to a mobile device’s various system parameters. Once deployed on a mobile device, Zimperium zIPS begins protecting the device against all primary attack vectors, even when the device is not connected to a network.
With Zimperium zIPS, organizations gain continuous protection for mobile devices, providing the risk intelligence and forensic data necessary for security administrators to raise their mobile security confidence. As the mobile attack surface expands and evolves, so does Zimperium’s on-device, machine learning-powered detection.