What is malware?

Malware in plain English

Not all software is harmless. Some programs are built specifically to cause damage or to give attackers an advantage. All of them are grouped under the term malware – just as “pests” is an umbrella term for very different creatures that cause damage in homes and gardens.

Malware rarely arrives with a bang. It often disguises itself as an invoice attachment, a useful tool, or an update. Once launched, it usually works in secret: it records passwords, opens a back door, or waits for commands from the internet. Many victims only notice the infection once the real damage is done.

How malware works

Malware comes in many forms. The most important types:

1. Viruses attach themselves to files or programs and spread when these are opened.
2. Worms spread on their own across the network, without anyone having to click anything.
3. Trojans disguise themselves as useful programs and cause damage in the background – for example, by opening a back door for attackers.
4. Spyware and keyloggers spy on users and record their keystrokes, for example.
5. Infostealers specifically steal stored passwords and login credentials – from the browser, for example.
6. Ransomware encrypts data and systems in order to extort a ransom.

Typical ways into a company are attachments and links in phishing emails, manipulated downloads, and infected USB drives. Then there are vulnerabilities in systems that are reachable from the internet – for example, in VPN gateways that employees use to access the corporate network from outside. Once it has been launched, modern malware often downloads additional modules and checks in with a command-and-control server run by the attackers, which sends it new commands.

A practical example

Here’s a typical scenario: An employee in the accounting department of a furniture manufacturer receives an email containing what appears to be a payment reminder from a supplier. She opens the attached document. Unnoticed, an infostealer installs itself and reads stored passwords from the browser – including the credentials for remote access to the corporate network. Weeks later, attackers use this access, spread through the network (lateral movement), and finally encrypt the servers. Only the forensic investigation reveals how it all began: with a single email attachment.

Why does this matter for businesses?

Malware is the tool behind many cyberattacks. The consequences range from the theft of customer data and trade secrets to business interruptions and extortion. Legal obligations come on top of that. If personal data is affected, the data breach must be reported to the competent supervisory authority under Art. 33 GDPR without undue delay and, where feasible, within 72 hours. This obligation only lapses if the breach is unlikely to result in a risk to the individuals concerned. Companies in Germany that fall under NIS2 must also report significant security incidents to the joint reporting office of the BSI (Germany’s Federal Office for Information Security) and the BBK (Federal Office of Civil Protection and Disaster Assistance) – with the early warning due no later than 24 hours after becoming aware of the incident.

It’s also important to understand that removing only the visible malware often doesn’t solve the problem. Attackers frequently leave additional back doors behind or have long since stolen credentials. That’s why you need to establish how the malware got in, what it did, and which systems are affected.

How to protect your organization

• Install updates promptly: Structured patch management closes the gaps through which malware gets in.
• Monitor endpoints: Modern security solutions such as EDR detect suspicious behavior, not just known malware.
• Limit privileges: Work without administrator rights in day-to-day use – this makes it harder for malware to gain a foothold.
• Filter and train: Email filters and trained employees complement each other.
• Keep backups separate: Regularly tested backups that are disconnected from the network are your lifeline in an emergency.
• Have an emergency plan ready: Define who makes decisions if you suspect an infection and whom you call.
• Respond correctly if you suspect an infection: Inform your IT team or your emergency contact immediately. Disconnect affected devices from the network, but avoid switching them off if possible – memory often holds important traces.

How Rootsektor can help

Our Malware Analysis service determines exactly what a suspicious program does, who it communicates with, and how it persists on your systems – including indicators of compromise (IoCs) that your team can use to find infected systems. Our Digital Forensics team reconstructs how the malware got into the network and which systems are affected, with a documented chain of custody; we offer both services on an individual basis. In an acute incident, you can reach us at +49 2932 465265-0. Outside our business hours – Mon–Fri, 8:00 a.m.–5:00 p.m. (CET/CEST) – the same number is our 24/7 emergency hotline. You’ll find immediate steps and a reporting form on our Report an Emergency page.