Malware Types
Malware ke alag-alag forms — sab damage karte hain, par alag tarike se
Virus ek malicious code hai jo existing files mein attach ho jaata hai. Jab infected file run karo, virus execute hota hai aur doosri files ko infect karna shuru karta hai. Human action required hai spread ke liye (file share karo).
Human help required. Automatic nahi spread hota. Tumhe infected file kisi ko deni padti hai — email, USB, download se. Biological virus jaisa — carrier chahiye.
Biological flu virus jaisa. Apne aap nahi chalta — kisi infected insaan se contact chahiye. Ek infected USB → tumhara PC → tumhara shared drive → colleagues.
ILOVEYOU (2000): Email attachment "LOVE-LETTER-FOR-YOU.txt.vbs" — millions ne open kiya, $10 billion damage, 50 million computers infected in 10 days.
Worm standalone hai — kisi file se attach nahi hota, koi human action nahi chahiye. Network vulnerabilities exploit karke apne aap spread hota hai. Ek infected machine → poora network.
Network bandwidth kha jaata hai, servers overload karta hai. Side payloads bhi carry karta hai — ransomware, keyloggers deliver kar sakta hai automatically.
WannaCry (2017): EternalBlue exploit (NSA ka stolen tool) use karke Windows SMB vulnerability pe attack. No user action needed — bas network connection chahiye tha. 300,000+ computers 150 countries mein.
Legit software ki tarah dikhta hai (game, utility, crack) par andar malicious code hota hai. Tum khud install karte ho. Greek mythology ke Trojan Horse jaise — gift ke andar soldiers.
Banking Trojans (credentials chori), RATs (remote access), Backdoor Trojans (attacker ka entry point), Downloader Trojans (aur malware download karte hain).
Zeus Trojan (2007-2010): Banking credentials chori karta tha. 70,000+ organizations affect, $70 million+ stolen including NASA computers. Ek pirated game ke saath typically aata tha.
OS ke deepest level (kernel) mein install hota hai. Apne aap ko aur doosre malware ko antivirus se hide karta hai. "Root" = highest admin access, "Kit" = tools.
Standard antivirus detect nahi kar paata. OS ke andar se hi system calls intercept karta hai aur fake information return karta hai. Remove karna almost impossible.
Sony BMG CD Rootkit (2005): Sony ne music CDs mein rootkit embed kiya DRM ke liye. 22 million CDs affected. Users ke computers pe bina bataye install ho jaata tha. Massive lawsuit, public outrage.
Background mein quietly tumhare keyboard ke har key press ko record karta hai. Phir log file attacker ko bhejta hai. Tumhara bank password, personal messages, credit card — sab caught.
Software: OS level mein hook
Hardware: Physical device keyboard aur PC ke beech
Browser-based: Form data intercept
- Virtual keyboard use karo banking ke liye
- 2FA se keylogger useless ho jaata hai passwords ke liye
- Physical keyboard ports check karo public computers pe
Background mein chup ke tumhari activities monitor karta hai — browsing history, location, contacts, camera/microphone access, screenshots. Data attacker ko remotely bhejta hai.
Keylogger sirf keystrokes, Spyware broader — screenshots, file access, location, social media, call logs sab.
Pegasus Spyware (NSO Group): iOS aur Android zero-click exploit se install hota tha — tumhe kuch click bhi nahi karna. Journalists, activists, world leaders ke phones compromise. Saudi Arabia ne use kiya journalist Jamal Khashoggi ke network ko monitor karne ke liye.
Automatically ads show karta hai — popups, browser redirects, fake alerts. Revenue generate karta hai advertiser ke liye. Free software ke saath bundled aata hai often.
Mostly annoying, but some adware spyware ka gateway hai. Malvertising (malicious ads) se serious malware download ho sakta hai. Browser settings hijack kar leta hai.
Disk pe koi file nahi likhta. Directly RAM mein run karta hai ya Windows ke legitimate tools (PowerShell, WMI) ko abuse karta hai. Antivirus file scan nahi kar sakta kyunki file hi nahi hai.
Living-off-the-land (LotL) attack. PowerShell, cmd, regedit — Windows ke apne tools use karta hai. Computer restart pe woh gone — par tab tak kaafi damage kar chuka hota hai.
Operation Cobalt Kitty (2017): Vietnamese bank pe APT attack. 6 mahine tak undetected raha kyunki PowerShell aur WMI tools use karta tha. $200M+ theft attempt.
Attacker tumhara poora computer remotely control kar sakta hai — mouse, keyboard, camera, microphone, files, install software. TeamViewer jaisa, but without your knowledge.
Screen dekh sakta hai live, camera on kar sakta hai, files copy/delete, keylog, bank transfers, screenshot, aur tumhare PC ko botnet mein add.
Blackshades RAT (2012-2014): 17-year-old Swedish teen ne banaya, $40 pe dark web pe becha. 700,000 computers compromise. Miss Teen USA ki webcam se photos leak. FBI ne worldwide sting operation chalayi.
SaaS ki tarah, but evil. Ransomware developers apna malware dark web pe "rent" pe dete hain. Koi bhi coding nahi jaanta buy kar sakta hai, attack kar sakta hai. Revenue split hoti hai developer aur attacker ke beech.
70-30 split typically. Developer 30% leta hai ransom ka, attacker 70%. Support bhi milta hai, control panel, ransom negotiation services. Full criminal enterprise.
DarkSide RaaS: Colonial Pipeline attack isi se hua. Professional website thi, customer support, even a "code of ethics" — hospitals attack mat karo. Pure criminal SaaS business.