Understanding Malware: Types, History, Impact, Prevention, and Response

Malware is a category, not a single threat

The word malware is short for malicious software. It covers software or firmware intentionally used to perform an unauthorized, harmful action. That harm may involve stealing credentials, monitoring a person, encrypting business data, disrupting a service, hiding another implant, hijacking a device, or destroying information. The NIST malware glossary emphasizes adverse effects on confidentiality, integrity, or availability and includes viruses, worms, Trojan horses, spyware, rootkits, and some forms of adware.

That broad definition matters because real incidents rarely fit one neat label. A malicious document may launch a downloader. The downloader may install an information stealer. Stolen credentials may give an intruder remote access. The intruder may later deploy ransomware and steal files for extortion. Calling the whole event “a virus” hides the chain defenders need to understand.

This guide explains the main categories, the history that shaped them, why infections happen, how harm spreads, and what individuals and organizations should do before and after an incident. It is an awareness guide—not a substitute for incident-specific technical, legal, regulatory, insurance, or law-enforcement advice.

Figure 1. Malware names often describe how code spreads, what it pretends to be, what capability it provides, or what outcome it pursues. One sample can belong to several categories.

If you suspect an active infection: stop using the affected device for normal work, isolate it from networks if you can do so safely, and contact your IT or security team. Do not upload unknown files, memory captures, logs, or business data to public services. Evidence can contain credentials, personal information, internal paths, messages, and other sensitive material.

What malware is—and what it is not

Several related terms answer different questions:

• A vulnerability is a weakness. It is not malware.
• An exploit is a method or code that takes advantage of a weakness. It may deliver malware, but the terms are not interchangeable.
• Phishing is a deception technique. It may lead to credential theft, fraudulent payment, or malware delivery without itself being malware.
• A potentially unwanted application (PUA) may use aggressive advertising, bundling, browser changes, or misleading installation practices. Some adware is treated as malware; other software falls into a separate unwanted-software category. Microsoft, for example, publishes distinct malware and potentially unwanted application criteria.
• Living off the land describes abuse of legitimate tools already present in an environment. The harmful activity can be real even when no new conventional malware file is found.
• Fileless usually describes an execution or persistence approach, not a guarantee that no file, script, registry value, remote payload, or forensic artifact exists anywhere in the chain.

These distinctions prevent two common errors: assuming every unusual program is malware, and assuming an incident is harmless because investigators have not found a traditional executable.

A short history of malware

Malware history is also a history of changing connectivity. Early experiments and viruses spread through research networks or removable media. Email and the public internet enabled global worms. Online banking created markets for credential stealers. Cryptocurrency made extortion and illicit payments easier to scale. Cloud services, identity systems, software supply chains, smartphones, and internet-connected devices expanded both the attack surface and the consequences.

Figure 2. Selected milestones illustrate changes in propagation and impact. This is not a complete history or a count of global incidents.

1971: Creeper as a precursor, not a modern crime campaign

Bob Thomas's Creeper program moved among TENEX computers on the ARPANET as an experiment. A Computer History Museum archive preserves Thomas's description of Creeper and the Reaper program created to find and remove it. Creeper is useful as a historical precursor to network-moving code, but describing it as equivalent to modern financially motivated malware would erase its context. See the Computer History Museum's archived account.

1986–2000: personal computers, removable media, and email

The 1986 Brain boot-sector virus demonstrated how code could spread through floppy disks; IBM's history of malware places it within the removable-media era that preceded widespread internet adoption. In 1988, the Morris Worm became the first major attack on the early internet. The FBI's historical account says an estimated 6,000 of roughly 60,000 connected computers were affected within 24 hours; systems slowed or became unusable even though the worm was not designed to destroy files.

By 1999 and 2000, mass-mailing malware showed how trust and address books could amplify a lure. The FBI's archived cybersecurity testimony records the global spread of the ILOVEYOU attachment in May 2000 and its impact on government and private-sector systems. The lesson remains current: software does not need a sophisticated exploit when a convincing message can persuade a user to start the chain.

2010: Stuxnet and cyber-physical consequences

Stuxnet brought industrial-control malware into public awareness. CISA's archived Primary Stuxnet Advisory documented multiple propagation paths, including infected USB devices, network shares, project files, and Windows vulnerabilities, as well as interaction with Siemens control software. It demonstrated that malicious code could reach beyond office data and interact with specialized industrial processes.

2013–2017: scalable extortion, IoT botnets, and destructive outbreaks

CryptoLocker helped establish modern crypto-ransomware. The U.S. Department of Justice said it began appearing around September 2013 and used cryptographic key pairs to encrypt victims' files; a multinational operation later disrupted infrastructure associated with it. See the DOJ's CryptoLocker and Gameover Zeus action.

In 2016, Mirai turned poorly secured internet-connected cameras, recorders, routers, and other devices into a large botnet. DOJ records describe Mirai's use for powerful distributed denial-of-service attacks and later variants. The original Mirai case is an enduring warning that default credentials and exposed management services can turn consumer devices into infrastructure for attacks on other people.

In May 2017, WannaCry combined ransomware with worm-like propagation. UK government reporting says it affected 150 countries and 48 NHS trusts. CISA maintains an archived WannaCry indicators advisory, while the UK described its scale and disruption in an official cyber and international law speech.

NotPetya followed in June 2017. It presented a ransom demand but was principally destructive. The UK government said it masqueraded as a criminal enterprise, primarily targeted Ukrainian sectors, and spread beyond them with indiscriminate effects. That distinction is important: an on-screen ransom note does not prove that data can be recovered by paying. See the UK's NotPetya attribution statement.

2021–2024: operational concentration and societal disruption

The 2021 Colonial Pipeline incident showed how a compromise of business systems could contribute to a precautionary operational shutdown of critical infrastructure. The U.S. Department of Justice reported that portions of the company's infrastructure were taken out of operation and later seized part of the ransom proceeds. See the DOJ seizure announcement.

In February 2024, the Change Healthcare ransomware incident disrupted healthcare and billing systems across the United States. The U.S. Department of Health and Human Services described a nationwide operational impact and later confirmed that Change Healthcare filed a breach report concerning a ransomware attack involving protected health information. See the HHS incident FAQ and HHS letter to the healthcare sector.

These events do not mean every malware incident becomes a national crisis. They show how concentration, interdependence, identity access, and weak recovery options can turn a technical compromise into a business or public-service emergency.

The major malware categories

Figure 3. Malware labels operate at different layers. Virus and worm describe replication; Trojan describes disguise; spyware and rootkit describe capabilities; ransomware and wiper describe outcomes.

NIST's malware guidance distinguishes viruses, worms, Trojan horses, malicious mobile code, blended attacks, backdoors, rootkits, and keyloggers. See NIST's overview of malware incident prevention and SP 800-83 Rev. 1. The categories below extend that foundation to terms commonly used in current public reporting.

Adware

Adware displays or injects advertising. At the less harmful end, a clearly disclosed, removable, ad-supported application may be a business model rather than malware. At the harmful end, software may arrive through deceptive bundling, resist removal, change browser settings, track behavior, redirect searches, install extensions, or deliver additional unwanted software.

The 1990s and early 2000s saw widespread bundling of advertising components with free software. Public concern grew when advertising, monitoring, and installation practices became difficult to distinguish from spyware. The U.S. Federal Trade Commission's spyware and malware resources describe how deceptive downloads, pop-ups, redirects, browsing monitoring, and keystroke capture can expose people to fraud and identity theft.

Watch for the boundary, not just the label: Was there informed consent? Is removal straightforward? Does the application collect more than it needs? Does it change security settings or install other components?

Virus

A computer virus replicates by inserting copies of itself into other code or data. Traditional examples include file infectors, boot-sector viruses, macro viruses, and script viruses. A virus normally spreads when an infected host is executed or opened. This dependence on a host distinguishes it from a standalone worm.

Viruses can corrupt files, alter documents, display messages, disable controls, or install additional payloads. Modern incidents use the word virus less precisely, but the technical distinction remains useful when deciding how an infection propagates and what must be restored.

Worm

A worm is a standalone program that replicates and spreads to other systems. It may scan for vulnerable services, reuse credentials, copy itself over shares, or use messaging systems. Worms can create harm simply by consuming bandwidth and system resources, even before an additional payload acts.

Morris, ILOVEYOU, WannaCry, and Mirai illustrate different generations of self-propagation: early internet services, trusted email contacts, network vulnerabilities, and exposed IoT devices. A worm's speed makes asset inventory, patching, segmentation, and practiced isolation especially important.

Trojan

A Trojan pretends to be useful, familiar, or expected. It may appear to be an invoice, game modification, software update, browser extension, cracked application, security tool, or business document. Unlike a virus or worm, a Trojan does not normally describe self-replication; it describes the deception that gets it executed.

Once started, a Trojan may steal data, install a backdoor, change settings, or fetch another payload. The name therefore says little about final capability. Analysts should identify both the disguise and the observed behavior.

Backdoor and remote-access Trojan

A backdoor provides access that bypasses the expected authentication or administration path. A remote-access Trojan (RAT) commonly lets an operator run commands, browse files, capture screens, record audio or keystrokes, transfer payloads, or control processes.

Remote administration software is also legitimate and widely used. The defensible question is not “Does this program support remote access?” but “Was it authorized, installed through an approved channel, bound to the expected operator and device, and used within policy?” Attackers frequently abuse genuine remote-management tools because they are capable and may blend into normal support traffic.

Spyware, keylogger, and information stealer

Spyware covertly observes a person or system. A keylogger records keystrokes. An information stealer focuses on high-value data such as browser passwords, cookies, session tokens, cryptocurrency wallets, email, payment information, documents, or application databases.

The damage can continue after the malicious process is gone. Stolen credentials may be reused elsewhere; stolen cookies may preserve a session; stolen identity information may support fraud months later. Response therefore includes password reset from a clean device, session and token revocation, mailbox and forwarding-rule review, and monitoring for secondary account abuse.

Ransomware and data extortion

Ransomware denies access to systems or data, often through encryption, and demands payment. Modern operations may first steal data and then threaten publication, a model known as double extortion. Some groups conduct extortion without encrypting data at all. CISA's StopRansomware Guide explains these models and provides prevention and response recommendations.

Ransomware is often a late stage of a longer intrusion. An operator may spend days or weeks using stolen credentials, remote tools, precursor malware, and administrative access before widespread encryption. A quiet period before detonation is not proof that nothing happened.

Payment creates difficult operational, legal, ethical, and sanctions questions. The FBI does not support paying and stresses that payment does not guarantee recovery. The U.S. Treasury's updated OFAC advisory warns of potential sanctions risk in some transactions. Victims should involve incident-response leadership, legal counsel, insurers where applicable, and relevant authorities rather than treating payment as a technical shortcut.

Rootkit and bootkit

A rootkit hides malicious activity or preserves privileged access by changing how a system reports files, processes, drivers, registry data, network connections, or security events. A bootkit starts in the boot chain, potentially before the operating system's normal defenses.

These capabilities undermine trust in the affected installation. Removing one visible file may not restore integrity. Depending on scope and assurance requirements, verified reimaging, firmware review, credential reset, and recovery from trusted media may be more defensible than attempting piecemeal cleanup.

Botnet malware

A botnet is a group of compromised devices controlled together. Operators can use it for distributed denial-of-service attacks, spam, credential attacks, ad fraud, proxy services, cryptomining, or delivery of other malware. The compromised owner may see only slower performance or unusual network use while third parties receive the attack traffic.

Botnets also show why cybersecurity is collective. An unpatched router or default-password camera can harm organizations its owner has never heard of. Updating firmware, changing default credentials, disabling unnecessary remote administration, and retiring unsupported devices reduce that shared risk.

Wiper

A wiper destroys data or makes systems unusable. It may overwrite files, damage boot structures, erase recovery information, or automate destructive changes across a network. NotPetya demonstrated that destructive malware can imitate ransomware while providing no practical recovery path through payment.

Wipers make restoration testing as important as backup creation. A backup that is online, writable from the compromised identity, undocumented, or never restored in a test may fail at the exact moment it is needed.

Cryptominer and cryptojacking

Cryptomining software uses computing power to generate cryptocurrency. It becomes malicious when installed or operated without authorization. Impacts include reduced performance, heat, accelerated hardware wear, power consumption, and unexpectedly high cloud bills. Cloud cryptojacking may begin with stolen API keys or an exposed workload rather than a conventional desktop infection.

Downloader and dropper

A downloader retrieves another payload. A dropper carries or reconstructs a payload and installs it. These are delivery roles, not final motives. One campaign can update the downloaded payload over time, so the same initial file may lead to different observed outcomes on different dates.

Why malware infections happen

An infection is rarely explained by one careless click. Successful attacks usually combine an entry path with conditions that allow execution, persistence, expansion, and impact.

Figure 4. A generalized infection chain. Real incidents may skip, repeat, reorder, or fail at stages; the diagram is a planning aid, not proof of one universal sequence.

Common entry paths

• Phishing and social engineering: urgent invoices, account warnings, job offers, shared documents, QR codes, and fake support calls can deliver files or steal credentials.
• Unpatched vulnerabilities: internet-facing services, browsers, document readers, VPN appliances, routers, and business applications may be exploited before an organization applies a fix.
• Stolen credentials and sessions: password reuse, infostealers, credential stuffing, token theft, weak recovery processes, and missing multi-factor authentication can provide direct access.
• Unsafe software sources: cracks, key generators, unofficial installers, fake updates, and repackaged applications can hide Trojans and stealers.
• Malvertising and compromised websites: a legitimate-looking page or advertisement can redirect users to deception or exploitation.
• Exposed remote services: poorly protected remote desktop, management panels, and remote-monitoring tools can become entry points.
• Supply-chain compromise: attackers may abuse a trusted vendor, software update, library, service provider, or administrator relationship.
• Removable media and shared files: USB devices, network shares, collaboration platforms, and macros can bridge security boundaries.

Conditions that increase impact

• Excessive administrator privileges
• Shared or reused credentials
• Flat networks with little segmentation
• Unsupported operating systems and devices
• Missing asset and software inventory
• Security tools that are absent, misconfigured, or not monitored
• Logs that are unavailable, overwritten too quickly, or disconnected from identity context
• Backups reachable through the same compromised accounts
• No tested incident-response or continuity plan
• Third-party access that is broader or longer-lived than necessary

Blaming a single user obscures these design failures. A resilient organization expects some messages to be clicked, some credentials to be stolen, and some vulnerabilities to exist. The goal is to prevent one failure from becoming total compromise.

The damage is larger than the infected device

Figure 5. Consequences propagate through technical and human dependencies. Not every incident produces every effect.

Malware can affect:

• People: identity theft, stalking, fraud, exposure of private communications, lost work, and emotional stress.
• Identity systems: stolen passwords, tokens, browser sessions, API keys, and privileged accounts.
• Data: theft, alteration, deletion, encryption, public release, or loss of provenance.
• Operations: unavailable systems, manual workarounds, delayed services, missed transactions, and unsafe operating conditions.
• Finances: fraud, response costs, downtime, legal work, replacement equipment, higher insurance costs, and lost revenue.
• Partners: compromised email or trusted access can be reused against customers, suppliers, and service providers.
• Compliance and trust: notification duties, investigations, contractual consequences, and reputational harm may outlast technical recovery.

The 2024 Change Healthcare disruption illustrates concentration risk: one major service provider's outage affected healthcare payment and administrative processes across a much wider ecosystem. Incident planning must therefore include dependencies that are not physically inside the organization's own network.

How to reduce the risk

No product or checklist prevents every incident. Effective defense uses overlapping controls so that prevention, detection, containment, and recovery do not depend on one tool.

Figure 6. Layered defense reduces both likelihood and impact. The layers require ownership, maintenance, testing, and visible failure states.

For individuals and families

1. Keep the operating system, browser, phone, router, and applications updated.
2. Install software only from trusted sources. Avoid cracks, unofficial repacks, and unexpected update prompts.
3. Use a password manager and a unique password for every important account.
4. Enable multi-factor authentication; prefer phishing-resistant methods such as passkeys or security keys where available.
5. Treat unexpected attachments, login prompts, QR codes, and urgent payment requests as untrusted until verified through another channel.
6. Keep security protection enabled and investigate repeated warnings instead of simply dismissing them.
7. Back up irreplaceable data to more than one location. Keep at least one copy disconnected or otherwise protected from ordinary account deletion.
8. Test that important files can actually be restored.
9. Remove unused browser extensions, remote-access tools, applications, and old accounts.
10. Change default passwords and disable unnecessary remote administration on routers, cameras, and other smart devices.

For organizations

1. Maintain an accurate inventory of devices, software, identities, data, internet-facing services, and critical dependencies.
2. Prioritize remediation of actively exploited and internet-facing vulnerabilities; verify that fixes reached the intended assets.
3. Require phishing-resistant MFA for email, remote access, administrators, and critical systems.
4. Apply least privilege, separate administrative accounts, limit service-account rights, and review access regularly.
5. Use application control and managed endpoint protection where appropriate; ensure alerts reach people who can act.
6. Segment networks and separate critical, administrative, user, backup, and operational-technology environments.
7. Secure and audit remote-management tools. Remove unauthorized instances and restrict approved tools to expected operators and paths.
8. Protect email and web workflows, but also train staff to verify unusual requests without punishment for reporting mistakes quickly.
9. Centralize useful identity, endpoint, network, cloud, email, and administrative logs with sufficient retention and time synchronization.
10. Maintain encrypted offline or immutable backups and regularly test full restoration. CISA emphasizes that accessible backups may also be encrypted or deleted by ransomware.
11. Prepare clean system images, configuration records, software sources, license information, dependency maps, and manual continuity procedures.
12. Create and exercise an incident-response and communications plan. Include executives, technical teams, legal counsel, privacy, communications, suppliers, insurers, and authorities appropriate to the organization.

The CISA StopRansomware Guide recommends offline or immutable backups, restoration testing, phishing-resistant MFA, asset management, least privilege, segmentation, logging, and an exercised response plan. NIST's malware incident guide similarly treats prevention and response as organization-wide capabilities rather than an antivirus-only problem.

What to do after a suspected infection

Figure 7. A safe response protects people and limits spread before restoration. Exact actions depend on the incident, environment, and legal jurisdiction.

Immediate actions for an individual

1. Stop sensitive activity. Do not continue banking, shopping, entering passwords, or opening business data on the suspected device.
2. Disconnect it from networks. Turn off Wi-Fi and unplug network cables where practical. Avoid reconnecting removable drives or backups.
3. Ask for help from a clean device. Contact organizational IT, a trusted support professional, bank, or relevant service provider as the situation requires.
4. Preserve basic facts. Record the time, what you observed, recent downloads or messages, and any ransom note. A photograph from a separate device may be safer than clicking around.
5. Secure accounts from a known-clean device. Change affected passwords, revoke sessions, review MFA methods and recovery details, and check email forwarding or payment changes.
6. Do not assume a quick scan restored trust. A serious compromise may require verified backup restoration or a clean reinstall.
7. Monitor for follow-on harm. Watch financial accounts, email, social accounts, cloud storage, and identity-recovery messages.

If spyware or stalkerware may be connected to domestic abuse, prioritize physical safety. Removing or confronting the software can alert the person monitoring the device. The FTC's stalkerware guidance recommends considering a different device and seeking specialist support.

Immediate actions for an organization

1. Activate the incident-response plan and establish leadership. Use a known-safe, out-of-band communication channel if the attacker may be monitoring email or collaboration systems.
2. Identify and isolate affected systems. CISA advises determining which systems are impacted and immediately isolating them. If individual disconnection is not feasible during widespread ransomware, coordinated network isolation may be required.
3. Prefer isolation over immediate power-off when evidence matters. Volatile memory and active network state can be valuable. CISA notes that powering down loses volatile evidence and should be a fallback when a device cannot otherwise be disconnected and spread must be stopped.
4. Protect human safety and critical services. Prioritize systems supporting health, safety, essential operations, and trustworthy communications.
5. Preserve evidence proportionately. Capture relevant logs, identity events, endpoint records, cloud audit data, system images, and memory where qualified responders determine it is appropriate. Document who collected what, when, from which system, and how it was protected.
6. Assess identity and scope, not just the first host. Review initial access, persistence, privileged accounts, remote tools, sessions, tokens, lateral movement, data access, exfiltration, backup access, and third-party connections.
7. Contain with exact identities. Block or reset the affected accounts, systems, keys, tokens, and infrastructure without assuming that a filename, IP address, or username alone identifies the whole intrusion.
8. Eradicate and rebuild from trusted sources. Remove persistence, close the entry path, rotate exposed secrets, and rebuild systems where integrity cannot be established.
9. Restore in a controlled order. Use clean networks and verified backups. Confirm prerequisites, security controls, logging, identity, and business function before returning a service to production.
10. Notify the right parties. Legal, regulatory, contractual, insurer, law-enforcement, employee, customer, and partner duties vary by jurisdiction and facts. Do not delay expert advice when sensitive data or essential services are involved.
11. Monitor for recurrence and secondary abuse. Attackers may retain credentials, cloud access, mailbox rules, API keys, or partner pathways after endpoints are rebuilt.
12. Conduct a lessons-learned review. Fix root causes, update diagrams and inventories, improve controls, retest restoration, and exercise the revised plan.

The NCSC incident-management collection emphasizes preparation because incidents can still happen despite security controls. Its 2026 guidance on recovering from highly disruptive attacks separates immediate containment and assessment, recovery, and longer-term rebuild. NIST also stresses preserving useful evidence before responders unintentionally alter system state; see the Computer Security Incident Handling Guide.

How to interpret a quiet result

No alert, one clean scan, or a small number of observed events does not prove inactivity. Collection may have started late, stopped early, missed a device, lacked a required provider, or observed an execution path that did not trigger during the window. Malware may wait for a date, command, user action, network condition, locale, privilege level, or authentic host application.

Conversely, a suspicious filename, import, string, advertisement, or remote-access capability does not by itself prove malicious execution or attacker intent. Defensible conclusions distinguish:

• Static evidence: what a file contains or appears capable of doing
• Runtime evidence: what was observed during a defined collection window
• Identity evidence: which exact process, file, account, device, or session was involved
• Inferred behavior: a reasoned interpretation supported by evidence but not directly observed
• Unavailable coverage: evidence that was not collected or could not be trusted
• Impact evidence: what data, service, person, or business function was actually affected

Awareness is most useful when it produces careful action rather than panic. Treat warnings seriously, preserve uncertainty, protect sensitive evidence, and involve qualified responders early.

Practical checklist

Before an incident

• [ ] Know your critical devices, accounts, data, services, and dependencies.
• [ ] Patch supported systems and retire unsupported ones.
• [ ] Use unique passwords and phishing-resistant MFA.
• [ ] Limit administrator and remote-access privileges.
• [ ] Keep endpoint protection and useful logging operational.
• [ ] Segment critical environments.
• [ ] Maintain offline or immutable backups and test restoration.
• [ ] Establish reporting and incident-response contacts.
• [ ] Exercise the plan, including communications without normal email.

During an incident

• [ ] Protect people and essential operations.
• [ ] Isolate affected systems and accounts.
• [ ] Use clean, out-of-band communications.
• [ ] Preserve relevant evidence and timestamps.
• [ ] Determine scope before declaring containment.
• [ ] Seek legal, regulatory, insurer, and law-enforcement guidance as appropriate.

During recovery

• [ ] Rebuild from trusted sources when system integrity is uncertain.
• [ ] Rotate exposed passwords, tokens, keys, sessions, and recovery methods.
• [ ] Restore in priority order and verify each service.
• [ ] Monitor for recurrence and partner impact.
• [ ] Document lessons and test the improved controls.

References

• National Institute of Standards and Technology, Malware glossary.
• NIST, SP 800-83 Rev. 1: Guide to Malware Incident Prevention and Handling, July 2013.
• NIST, Preventing and Handling Malware Incidents, December 2005.
• NIST, SP 800-61 Rev. 2: Computer Security Incident Handling Guide, August 2012.
• IBM, The history of malware.
• Computer History Museum archive, Bob Thomas account describing Creeper and Reaper.
• Federal Bureau of Investigation, The Morris Worm, November 2, 2018.
• FBI archive, Cyber Security testimony, August 29, 2001.
• CISA, Primary Stuxnet Advisory.
• U.S. Department of Justice, Multinational action against Gameover Zeus and CryptoLocker, June 2, 2014.
• U.S. Department of Justice, Computer crime cases involving the Mirai botnet, December 13, 2017.
• CISA, Indicators Associated With WannaCry Ransomware.
• UK Government, Cyber and International Law in the 21st Century, May 23, 2018.
• UK Government and NCSC, NotPetya attribution statement, February 15, 2018.
• U.S. Department of Justice, Cryptocurrency seizure following the Colonial Pipeline ransomware attack, June 7, 2021.
• U.S. Department of Health and Human Services, Change Healthcare Cybersecurity Incident FAQ.
• HHS, Letter regarding the Change Healthcare cyberattack, March 13, 2024.
• CISA, FBI, NSA, and MS-ISAC, StopRansomware Guide, September 2023.
• FBI, Ransomware guidance.
• U.S. Department of the Treasury, Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments, September 21, 2021.
• Europol, Cyber Attacks: The Apex of Crime-as-a-Service, September 13, 2023.
• UK National Cyber Security Centre, Incident management.
• UK National Cyber Security Centre, What to do when cyber attacks disrupt your organisation, July 28, 2026.
• U.S. Federal Trade Commission, Spyware and Malware.
• FTC Consumer Advice, Stalkerware: What To Know.
• Microsoft, How Microsoft identifies malware and potentially unwanted applications.