2.3 Malware Classifications, Ransomware & Living-off-the-Land

🎯 Key CompTIA Security+ Exam Takeaways

• Ransomware encrypts critical files; modern double extortion combines encryption with data exfiltration and dark-web leak threats.
• Trojans masquerade as benign software while secretly installing backdoors, Remote Access Trojans (RATs), or spyware.
• Rootkits operate at kernel (ring 0) or firmware levels, actively hooking system calls to conceal their processes and sockets from antivirus.
• Botnets consist of compromised zombies commanded via centralized or P2P Command and Control (C2) servers for DDoS or proxying.
• Fileless malware resides purely in volatile RAM, leveraging legitimate native OS utilities (LOLBins like PowerShell, certutil) to evade disk-based scanners.

Malware encompasses all software intentionally designed to cause damage, compromise data, or gain unauthorized access. Understanding malware behavior is essential for modern SOC analysis. Trojans appear as legitimate applications (utilities, codec updates) while concealing hidden malicious payloads such as Remote Access Trojans (RATs) that establish outbound command-and-control tunnels.

Ransomware has evolved from simple file-encrypting malware into sophisticated enterprise double-extortion campaigns. Adversaries gain initial access, move laterally, exfiltrate gigabytes of sensitive data, delete volume shadow copies, and deploy encryption payloads simultaneously across the enterprise. Even if an organization restores data from offline backups, attackers extort payment under threat of leaking proprietary IP or regulatory PII publicly.

Rootkits operate at the most privileged levels of the operating system (kernel mode or hypervisor firmware). By hooking low-level system APIs, a rootkit intercepts operating system queries, filtering out its own processes, registry keys, and network connections so that native utilities like Task Manager report clean system health. Fileless malware operates without writing executable binaries to the disk, injecting shellcode directly into legitimate running processes (like `explorer.exe` or `svchost.exe`) and executing commands via native Living-off-the-Land Binaries (LOLBins).

⚠️ Common Pearson VUE Exam Traps

• Believing backups alone completely solve ransomware; double extortion threatens public release of stolen customer data regardless of backup availability.
• Assuming traditional signature-based antivirus catches all malware; fileless malware leaves no executable files on disk and requires behavioral EDR detection.