6.2 Ransomware, Spyware, Trojans, and Viruses
Ransomware: Encryption as a Business Model
Modern ransomware does not destroy data -- it holds the key hostage. The typical build generates a random symmetric key (AES) per file or per volume to encrypt content fast, then encrypts that symmetric key with an embedded RSA public key whose private half lives only on attacker infrastructure. This hybrid envelope means the victim cannot brute-force recovery: the math is sound, so the ransom is the only advertised exit. Current operations add double extortion -- data is exfiltrated before encryption and threatened with public leak-site disclosure -- and often pre-strike with an interactive intrusion to delete backups, shadow copies (vssadmin delete shadows), and endpoint agents.
Spyware and the Trojan Facade
Spyware is surveillance code: keyloggers installed as keyboard hooks or raw-input filters, screen-capture loops, clipboard sniffers, and form grabbers that scrape credentials out of browser memory. Its economics are quiet -- value comes from what it observes over weeks, so it avoids noisy behavior. Trojans are defined not by their payload but by their promise: legitimate-looking wrappers -- fake updaters, cracked software, "invoice PDF" executables -- that persuade a user to run them. A remote-access trojan (RAT) then gives an operator an interactive shell, keylogging, and file transfer inside one implant, making the trojan the delivery vehicle that spyware, stealers, and ransomware ride in on.
Viruses: The Original Replicators
A virus is code that attaches itself to another object and requires that object's execution to propagate: file infectors prepend themselves to PE binaries or overwrite the entry point, macro viruses embed in Office documents, boot-sector variants hijack the MBR. Replication, not payload drama, is the definition. In practice the classic self-spreading virus has ceded ground -- today's mass spreaders are worms like WannaCry's SMB-exploiting payload, while criminal economics favor the controlled delivery of trojans over the chaos of viral replication.
One Family Tree, Many Payload Stages
The four labels answer different questions: ransomware says what it does to data, spyware says what it observes, trojan says how it arrived, virus says how it replicates. A single intrusion can chain all four -- a trojan drops a spyware stealer, the collected credentials buy VPN access, and ransomware arrives at the end of the chain. Classification matters for response: contain, then identify which question each artifact answers.
Architecture Diagram
Key Takeaways
- Ransomware uses hybrid AES+RSA envelopes: recovery is mathematically gated by an attacker-held private key, not by broken crypto.
- Double extortion encrypts and exfiltrates -- backups alone no longer end the incident.
- Spyware is judged by what it sees (keys, screens, forms), trojans by how they arrived (deception), viruses by how they replicate (host objects).
- RATs blend all four roles: delivered by trojan trick, observing like spyware, and pre-positioning ransomware.
- Incident response should classify each artifact by which question it answers, then contain along the chain.