The Attack That Shut Down 100 Romanian Hospitals

In February 2024, a ransomware attack hit over 100 hospitals across Romania, forcing them offline and back to pen-and-paper operations. Patient data was encrypted. Emergency services were disrupted. The attack vector? Malware that slipped through a single vulnerable system and spread laterally across the healthcare network.

If you're asking what is malware, that incident is the answer in action. Malware is any software intentionally designed to damage, disrupt, or gain unauthorized access to computer systems. But that textbook definition barely scratches the surface of what I've seen malware do to organizations over the past two decades.

This post breaks down the real types of malware, how threat actors actually deliver it, what it does once inside your network, and the specific steps your organization needs to take right now. No theory — just the practical knowledge that keeps systems running and data safe.

What Is Malware, Exactly?

Malware is short for "malicious software." It's an umbrella term covering any program or code created to harm a system, steal data, or exploit resources without the owner's consent. That includes everything from a simple keylogger to a sophisticated nation-state backdoor.

The key distinction: malware is defined by intent, not by method. A legitimate remote access tool becomes malware the moment a threat actor deploys it without authorization to control your systems. The Verizon 2024 Data Breach Investigations Report found that malware was a component in a significant share of confirmed breaches, with ransomware and data-stealing malware leading the pack (Verizon DBIR).

I've responded to incidents where the malware was a 12-line Python script. I've also seen custom-compiled binaries that evaded every antivirus engine on VirusTotal. Complexity doesn't define malware. Malicious purpose does.

The 8 Types of Malware You'll Actually Encounter

Security vendors love inventing categories. Here are the ones that matter in real-world incident response.

1. Ransomware

Ransomware encrypts your files and demands payment for the decryption key. Groups like LockBit, BlackCat (ALPHV), and Cl0p have turned this into a multi-billion-dollar criminal industry. The FBI's Internet Crime Complaint Center (IC3) reported that ransomware complaints continued to rise, with critical infrastructure sectors being primary targets (FBI IC3).

Modern ransomware doesn't just encrypt — it exfiltrates data first, then threatens to publish it. This "double extortion" model means backups alone won't save you.

2. Trojans

Named after the Greek myth for a reason. Trojans disguise themselves as legitimate software — a browser update, a PDF viewer, a cracked application. Once executed, they open a backdoor, install additional payloads, or begin stealing credentials.

Remote Access Trojans (RATs) are the most dangerous subset. They give an attacker full, persistent control over a compromised machine. I've seen RATs sit dormant for months before activation.

3. Spyware and Keyloggers

Spyware monitors your activity — browsing history, application usage, file access. Keyloggers specifically record every keystroke, capturing passwords, messages, and financial data in real time.

These often arrive bundled with trojans or as secondary payloads. Credential theft from keyloggers feeds the underground market for stolen accounts.

4. Worms

Worms self-replicate and spread across networks without any user interaction. The WannaCry attack of 2017 is the textbook example — it exploited the EternalBlue vulnerability in Windows SMB and infected over 200,000 machines in 150 countries within days.

Worms are less common now than a decade ago, but they remain devastating when they appear because of their speed of propagation.

5. Rootkits

Rootkits burrow deep into the operating system — sometimes into the firmware or boot process — to hide their presence. They can conceal files, processes, and network connections from standard security tools.

Detecting rootkits often requires specialized forensic analysis or booting from external media. They're the reason I always tell organizations: if a system is confirmed compromised, reimage it. Don't try to "clean" it.

6. Adware

Adware displays unwanted advertisements, often through browser hijacking. While less dangerous than ransomware, it degrades system performance, can redirect users to malicious sites, and often indicates deeper compromise.

7. Fileless Malware

This is the one that keeps security teams up at night. Fileless malware operates entirely in memory, leveraging legitimate tools like PowerShell, WMI, or Windows Management Instrumentation. It leaves minimal forensic artifacts on disk.

Traditional antivirus that scans files on disk misses fileless attacks entirely. Endpoint Detection and Response (EDR) tools that monitor process behavior are essential to catch these.

8. Wipers

Wipers exist purely to destroy data. No ransom demand, no exfiltration — just destruction. The NotPetya attack in 2017 masqueraded as ransomware but was actually a wiper. It caused an estimated $10 billion in global damages, according to the White House.

How Malware Actually Gets Into Your Network

Understanding what malware is matters less than understanding how it arrives. In my experience, the delivery method is where prevention happens.

Phishing: Still the Number One Vector

The Verizon DBIR consistently identifies the human element — particularly phishing and social engineering — as a factor in the majority of breaches. A convincing email with a malicious attachment or link remains the most reliable way for attackers to deploy malware.

This is exactly why phishing awareness training for organizations is a critical defense. Your employees are your first line of detection. If they can't recognize a phishing attempt, your technical controls are fighting with one hand tied behind their back.

Exploiting Vulnerabilities

Unpatched software is an open invitation. Threat actors scan the internet constantly for known vulnerabilities. CISA maintains a Known Exploited Vulnerabilities Catalog that lists the specific flaws being actively used in attacks (CISA KEV Catalog). If your organization isn't patching against that list, you're already behind.

Drive-By Downloads

Visiting a compromised or malicious website can trigger an automatic download. The user doesn't click anything — the exploit kit on the site identifies a browser or plugin vulnerability and delivers the payload silently.

Removable Media and Supply Chain

USB drives left in parking lots still work. Supply chain attacks — where malware is injected into legitimate software updates — are harder to detect and increasingly common. The SolarWinds attack demonstrated how a single compromised update can give attackers access to thousands of organizations.

What Happens After Malware Gets In

Most people think malware detonates immediately. That's rarely the case.

Modern malware follows a kill chain. It establishes persistence (surviving reboots), escalates privileges (gaining admin access), performs reconnaissance (mapping your network), moves laterally (jumping to other systems), and only then executes its final objective — whether that's data exfiltration, encryption, or destruction.

This dwell time — the gap between initial compromise and detection — averages over 200 days in many studies. That means malware can live inside your network for months before anyone notices. Every day of dwell time increases the damage exponentially.

The $4.88M Lesson Most Organizations Learn Too Late

IBM's Cost of a Data Breach Report 2024 pegged the global average cost of a data breach at $4.88 million. A significant portion of those breaches involved malware as the initial attack vector or as the tool used for data exfiltration.

Here's what drives that cost: forensic investigation, legal fees, regulatory fines, customer notification, credit monitoring, lost business, and reputational damage. The organizations that pay the least are the ones that detect and contain fast — which requires both trained people and proper tools.

Investing in cybersecurity awareness training isn't a nice-to-have. It's a direct financial defense against the most common malware delivery methods.

How to Defend Against Malware: Specific Steps That Work

I'm not going to tell you to "be careful online." Here's what actually reduces malware risk.

Deploy Multi-Factor Authentication Everywhere

Even if malware steals credentials through a keylogger, multi-factor authentication (MFA) blocks the attacker from using them. Prioritize MFA on email, VPN, cloud services, and any administrative access. Hardware security keys are the strongest option.

Adopt a Zero Trust Architecture

Zero trust means no device, user, or application is trusted by default — even inside your network. Every access request is verified. This limits lateral movement, which is how malware spreads from one compromised machine to your entire domain. NIST Special Publication 800-207 provides the framework (NIST SP 800-207).

Implement Endpoint Detection and Response

Traditional antivirus is necessary but insufficient. EDR solutions monitor process behavior in real time and can detect fileless malware, living-off-the-land techniques, and anomalous lateral movement that signature-based tools miss entirely.

Patch Aggressively

Prioritize patches based on CISA's Known Exploited Vulnerabilities list. Automate where possible. If you can't patch immediately, implement compensating controls — network segmentation, disabling vulnerable services, or applying virtual patches through your WAF or IPS.

Train Your People — Repeatedly

One-and-done security awareness training doesn't work. Effective training includes regular phishing simulations, short monthly modules, and immediate feedback when someone clicks a simulated malicious link. Security awareness has to become a habit, not an annual checkbox.

Segment Your Network

If ransomware hits one department, segmentation prevents it from reaching the rest of your organization. Flat networks — where every device can talk to every other device — are a dream for attackers.

Back Up Offline and Test Restores

Backups only help if they're offline (or immutable) and if you've actually tested the restore process. I've seen organizations discover their backups were corrupted only after ransomware had already encrypted production systems.

Quick Reference: What Is Malware and How Do You Stop It?

What is malware? Malware is any software intentionally designed to cause damage, steal data, or gain unauthorized access to systems. It includes ransomware, trojans, spyware, worms, rootkits, adware, fileless malware, and wipers. The most effective defenses combine technical controls like EDR, MFA, and zero trust architecture with ongoing security awareness training and phishing simulations to address the human attack surface.

The Threat Landscape in 2026

Malware is evolving faster than at any point in my career. AI-assisted malware can adapt its behavior to evade detection. Ransomware-as-a-Service platforms let low-skill criminals launch sophisticated attacks. Infostealers are commoditized — a threat actor can buy stolen session tokens for pennies and bypass MFA entirely.

But the fundamentals haven't changed. Malware still relies on unpatched vulnerabilities and human error to get in. Patch your systems. Train your people. Monitor your endpoints. Segment your networks. Verify every access request.

The organizations that do these things consistently — not perfectly, but consistently — are the ones that survive contact with a real threat actor. The ones that don't end up as the next headline.

Start building that consistency today. Explore cybersecurity awareness training at computersecurity.us and equip your team with phishing awareness training designed for organizations. Your network is only as strong as the people protecting it.