Malware Families and Behavior

Fileless claims only that the code which ran was never a normal executable file launched from disk; it arrived as data and became code in memory. It does not claim that nothing was written to disk.

The operator's own process has no business reaching the internet, and its traffic carries no user identity. Running inside the user's browser borrows that person's session, proxy settings and usual destinations, so the outbound traffic looks like their ordinary browsing rather than a strange new program phoning out.

Because the binary already carries the vendor's trust and is already installed. Nothing attacker-authored arrives as an executable, no install rights are needed, and the run collides with the administration the estate performs every day.

No. A rootkit conceals activity at a level the adversary already controls. Loading a kernel driver or writing firmware needs administrative privilege first, so concealment is something an intrusion buys after it has won, never a route to winning.

Blocking removable media and personal webmail closes two exits, not the class of exit. A bulk copy leaves through the sanctioned cloud storage, sharing links and sync the business itself requires and cannot switch off.

Because the operator is paid per install, not per victim. One pass copies the browser profile and other saved material into an archive, uploads it and exits. Staying would add cost and exposure for material already taken.

Because a copy of the data was taken before anything was encrypted. Restoring files ends the outage but not the threat to publish or sell what was already read, and the backup system itself is attacked early, not last.

The developer builds and maintains the encryptor, the builder and the affiliate panel and rents it out. The affiliate runs the intrusion itself - entry, spread, staging, launch - and keeps the larger share of whatever is paid.

The asset is the machine's capacity, not its contents. Mining only pays while the host stays up, so the operator avoids anything that would get it rebuilt: no encryption, no visible theft, no crash.

Whether anyone still holds a key that can reverse it. Ransomware keeps a per-victim key to sell back; a wiper overwrites data or generates a key and throws it away. The note is decoration and costs the operator nothing.

The two halves have different price tags. The first stage is cheap and disposable, built to survive one arrival. The capable second stage is fetched only once the host looks worth spending it on.

Four things at once: the next host exposes a service the spreading code can satisfy on its own, no step waits on a person, attempts succeed often enough to keep finding new hosts, and the code can name candidates to try.

Because the generator is deterministic. Algorithm plus seed — usually the current date and a constant compiled in — produces the same names for the implant and for anyone running the sample forward, so future names are computable, not secret.

Both change the arithmetic before the demand exists. Damaging the second copy removes the alternative to paying, and one virtualisation console reaches thousands of guests at once, so an entire estate falls in a single pass instead of host by host.

Because the encryptor is a rented product shared by many affiliates, while the intrusion is each affiliate's own work. Identical payload with divergent entry and movement is the predicted signature of a service model, not a contradiction to explain away.

Containers buy two different things and candidates name only one. An encrypted archive hides contents from inspection in transit. A mounted disk image historically launders the internet-zone marking, so the file inside runs as if never downloaded.

Interception yields plaintext only where the endpoint trusts the interception authority and does not pin, and exempt populations exist by design. Even where it works, the recovered body can be encrypted by the implant itself - and the destination was permitted anyway.

Memory-only describes the executable, not the residence. The body is normally parked as data with something durable to invoke it, so a reboot fires the trigger rather than removing it. And the way in stays open.

No. Injecting into a process at the same integrity level escalates nothing — the operator already held that user's rights. It buys the user's identity on outbound traffic, a permitted egress path and a plausible lifetime. Privilege is spent only when the operator crosses into a different user's session.

Reimaging is only sound above the level the implant occupies. Reinstalling the system volume can leave a boot component in the EFI System Partition; replacing the disk leaves platform-flash and option-ROM implants untouched.

Size intuition only catches the objective that is inherently bulky. An espionage objective is usually tens of megabytes - one design, one term sheet - and the price its operator pays is weeks of time on target, not bandwidth.

Rebuilding removes the code, not the copy. The archive left minutes after infection and has its own life - sold, resold, re-used - so exposure is clocked from resale and reuse, not from the infection date.

Because the miner was the product, not the access. The credential and the exposed path that placed it are untouched, so capacity is created again, and the loss accrues until that credential is rotated and the path closed.

Patch state addresses one route to one precondition. A spreader that logs in with a valid reused credential exploits nothing and is fully wormable on a patched estate, while a critical-rated flaw that needs someone to open a file is not wormable at any severity.

Because the first address gets seized, suspended or switched off, and an implant that cannot reach its operator is dead code. Fallback paths are the operator's insurance against losing an entire installed base to one removal.

The host never talks outside. It asks the internal resolver, which recurses on its behalf; the name asked for is attacker-chosen data, and the operator's own authoritative server answers it. Bytes cross both ways through a permitted intermediary.

The name's delegation. Addresses churn every few minutes among disposable relay hosts and, under double flux, the nameservers move too — but the parent zone's delegation of that name is single, static and held at the registry.

Gain: nothing on disk is a program, so hash blocking and executable allowlists have nothing to grab. Loss: it runs only where that interpreter already exists and is permitted, with capability capped by the language.

Hollowing starts a legitimate process suspended so it never actually runs, unmaps its original image from memory, writes the payload in its place, fixes the payload's relocations to wherever it landed, repoints the primary thread's entry at the payload, then resumes. The process ends up running code it was never loaded with.