Malware Types and Vehicles

1. Why This Topic Matters for the CFE Exam

Malware is one of the most heavily tested areas within the Computer and Internet Fraud portion of the CFE exam, which sits inside the Financial Transactions and Fraud Schemes section. The ACFE treats malware as a core enabler of cyberfraud: data theft, business email compromise, ransomware extortion, unauthorized funds transfers, and identity theft almost always begin with some form of malicious code reaching a victim system.

For a fraud examiner, understanding malware is not an IT-only skill. You must be able to:
- Recognize how a fraud scheme was technically carried out.
- Identify the entry point (the vehicle) so the organization can close it.
- Communicate with forensic specialists, legal counsel, and management using correct terminology.
- Recommend preventive controls that match the actual threat.

The exam tests definitions, distinctions, and delivery mechanisms. Candidates lose points not because the concepts are hard, but because several malware types sound similar (virus vs. worm vs. Trojan) and because the exam asks you to pick the most accurate term, not merely a plausible one.

2. What Is Malware?

Malware (short for malicious software) is any software intentionally designed to damage, disrupt, gain unauthorized access to, or steal information from a computer, network, or device without the informed consent of the owner. The ACFE Fraud Examiners Manual groups malware under computer and Internet fraud because it is a primary tool for committing financial crimes, stealing proprietary data, and extorting victims.

Key idea: malware is defined by intent and behavior, not by programming language or size. A tiny script that silently forwards payment data is malware; a large legitimate program with bugs is not.

3. The Major Malware Types You Must Know

Virus
- Malicious code that attaches itself to a host file or program (executable, document macro, boot sector).
- Requires human action to spread: the user must open, run, or share the infected file.
- Replicates by inserting copies of itself into other files.
- Exam distinction: needs a host and needs a user.

Worm
- A standalone, self-replicating program that spreads automatically across networks by exploiting vulnerabilities.
- Does not need a host file and does not need user interaction.
- Often consumes bandwidth and system resources, causing outages even without a destructive payload.
- Exam distinction: self-propagating, network-based, no host required.

Trojan Horse (Trojan)
- Malware that disguises itself as legitimate or desirable software (a game, utility, invoice, update).
- Does not self-replicate; it relies on tricking the user into installing it.
- Frequently opens a backdoor for remote access or drops other malware.
- Common subtypes: banking Trojans (steal online banking credentials), remote access Trojans (RATs), downloader/dropper Trojans.
- Exam distinction: deception-based, non-replicating.

Logic Bomb
- Malicious code that lies dormant until a specific condition is met (an employee is removed from payroll, a file is deleted, a particular user logs in).
- Frequently planted by insiders such as disgruntled programmers or IT staff.
- A time bomb is a logic bomb whose trigger is a specific date or time.
- Exam distinction: triggered by a condition; strong insider-threat association.

Ransomware
- Encrypts the victim's files or locks the system and demands payment (usually cryptocurrency) for the decryption key.
- Modern variants use double extortion: they also steal data and threaten to publish it.
- Often delivered via phishing attachments, Remote Desktop Protocol (RDP) compromise, or exploit kits.
- Scareware is a related type that uses fake warnings (fake antivirus alerts) to frighten users into paying or installing more malware.

Spyware
- Covertly monitors user activity and collects information (browsing habits, credentials, keystrokes) and sends it to a third party.
- Keyloggers are a spyware subtype that record every keystroke, capturing passwords, card numbers, and messages. Keyloggers can be software or hardware (a small device between keyboard and computer).
- Adware displays unwanted advertising; it becomes malware when it tracks users without consent or installs without permission.

Rootkit
- A set of tools designed to gain privileged (root/administrator) access while hiding its presence from the operating system and security software.
- Can modify the kernel, boot process, or firmware, making it extremely hard to detect and remove.
- Exam distinction: stealth and persistence.

Backdoor
- A hidden method of bypassing normal authentication to gain remote access. May be installed by a Trojan, left by a developer, or created by an attacker after a breach.

Bots and Botnets
- A bot (zombie) is an infected computer under remote control. A botnet is a network of such machines controlled through a command-and-control (C2) server.
- Used for distributed denial-of-service (DDoS) attacks, spam campaigns, click fraud, credential stuffing, and cryptomining.

Other Terms That Appear on the Exam
- Fileless malware: runs in memory using legitimate tools (PowerShell, WMI) and leaves little or no trace on disk.
- Polymorphic / metamorphic malware: changes its code or signature each time it replicates to evade signature-based antivirus.
- Cryptojacking: secretly uses the victim's processing power to mine cryptocurrency.
- Exploit kit: a toolkit hosted on compromised websites that scans visitors for vulnerabilities and delivers matching malware.
- Blended threat: malware combining characteristics of multiple types (for example, a worm that carries a Trojan payload and installs a rootkit).

4. Malware Vehicles: How Malicious Code Reaches the Victim

A vehicle (or delivery vector / infection vector) is the pathway malware uses to arrive on a target system. The exam frequently asks which vehicle was used in a scenario.

Email and Phishing
- The single most common vehicle. Malware arrives as an attachment (PDF, Office document with macros, ZIP, executable disguised with a double extension such as invoice.pdf.exe) or as a link to a malicious download.
- Spear phishing targets specific individuals; whaling targets executives.

Drive-By Downloads
- Malware downloads automatically when a user merely visits a compromised or malicious website, exploiting browser or plug-in vulnerabilities. No click on a download is required.

Malvertising
- Malicious code embedded in online advertisements served through legitimate ad networks, so even reputable websites can deliver it.

Watering Hole Attacks
- The attacker compromises a website that a specific target group is known to visit (an industry forum, a vendor portal) and waits for victims to arrive.

Removable Media
- Infected USB drives, external hard drives, or memory cards. USB baiting is leaving infected drives in parking lots or lobbies so curious employees plug them in. Historically, autorun features made this extremely effective.

Software Downloads and Bundling
- Malware hidden in pirated software, cracks, key generators, free utilities, browser toolbars, or fake updates (a fake Flash or browser update is a classic Trojan vehicle).

Social Engineering
- Phone calls (vishing), text messages (smishing), or social media messages that persuade the victim to install software or disable protections. Fake tech-support scams often end with a remote access tool being installed.

Network Propagation and Vulnerability Exploitation
- Worms spread by scanning for unpatched systems, weak or default passwords, or open services such as RDP and SMB. No user action is required.

Supply Chain Compromise
- Attackers insert malicious code into a trusted vendor's software update or hardware, so victims install it believing it is legitimate.

Mobile Vehicles
- Malicious apps in unofficial app stores, sideloaded apps, malicious QR codes, and SMS links.

Insider Installation
- Employees or contractors who deliberately plant logic bombs, backdoors, or keyloggers using their authorized access.

5. How Malware Works: The Infection Lifecycle

Understanding the sequence helps you answer scenario questions about where controls failed.

1. Delivery: the vehicle brings the code to the target (phishing email, USB, drive-by).
2. Exploitation: the code runs by exploiting a software vulnerability or by tricking the user into executing it.
3. Installation and Persistence: the malware establishes itself (registry keys, scheduled tasks, rootkit techniques) so it survives reboots.
4. Command and Control (C2): the malware contacts the attacker's server for instructions, updates, or to exfiltrate data.
5. Actions on Objective: the actual fraud or damage occurs: credential theft, fraudulent wire transfers, data exfiltration, encryption for ransom, or using the machine as a bot.
6. Propagation (for viruses and worms): the code copies itself to new hosts or systems.

Fraud examiners should note that evidence exists at each stage: email logs show delivery, endpoint logs show execution, network logs show C2 traffic, and financial records show the fraud outcome.

6. Quick-Reference Comparison

Virus: needs host file; needs user action; self-replicates.
Worm: no host needed; no user action needed; self-replicates over networks.
Trojan: disguised as legitimate; needs user to install; does NOT self-replicate.
Logic bomb: dormant until trigger condition; often insider-planted.
Time bomb: logic bomb triggered by date/time.
Ransomware: encrypts/locks; demands payment.
Spyware / keylogger: covert monitoring and data capture.
Rootkit: hides presence; gains privileged access.
Backdoor: bypasses authentication for remote access.
Botnet: network of compromised machines under C2.
Scareware: fake alerts to pressure payment or installation.

7. Prevention and Detection Controls (Often Tested as Remedies)

- Anti-malware software with regular signature updates plus behavior-based (heuristic) detection for polymorphic and fileless threats.
- Patch management to close vulnerabilities exploited by worms and drive-by downloads.
- Email filtering, attachment sandboxing, and disabling macros by default.
- Least privilege and removal of local administrator rights, limiting what malware can do once executed.
- Application whitelisting so unauthorized executables cannot run.
- Disabling autorun and restricting removable media.
- Network segmentation and egress filtering to block C2 communication.
- Offline, tested backups as the primary defense against ransomware.
- Security awareness training because the user is the vehicle in most cases.
- Code review and separation of duties in IT to deter logic bombs planted by insiders.
- Logging and monitoring (SIEM) to detect anomalies early.

8. Exam Tips: Answering Questions on Malware Types and Vehicles

Tip 1: Anchor on the two defining questions. For any malware type, ask (a) Does it need a host file? and (b) Does it need user action to spread? Virus = yes/yes. Worm = no/no. Trojan = no host, needs user to install, and never self-replicates. These two questions resolve most classification items.

Tip 2: Watch for the word 'disguised' or 'appears legitimate'. That language almost always points to a Trojan horse. If the question says the software 'claimed to be an update' or 'was downloaded as a free utility', choose Trojan.

Tip 3: 'Spread across the network without anyone doing anything' means worm. Automatic propagation and exploitation of vulnerabilities are the signature features. Do not pick virus just because the question mentions replication.

Tip 4: 'Dormant until' or 'activated when' signals a logic bomb. If the trigger is a date or time, the most precise answer is time bomb; if a time bomb option is not offered, logic bomb is correct. A scenario involving a terminated programmer whose code deleted files weeks after departure is a textbook logic bomb question.

Tip 5: Distinguish 'hides' from 'monitors'. If the emphasis is on concealment and administrator-level control, choose rootkit. If the emphasis is on covertly collecting information, choose spyware; if specifically on recording keystrokes, choose keylogger.

Tip 6: Payment demand equals ransomware; fake warning equals scareware. If files are encrypted and money is demanded for the key, it is ransomware. If a pop-up falsely claims the computer is infected to pressure a purchase, it is scareware.

Tip 7: Read vehicle questions for the trigger action. 'Simply visited a website' = drive-by download. 'Clicked a banner ad on a legitimate site' = malvertising. 'Site frequented by employees in that industry was compromised' = watering hole. 'Found a USB in the parking lot' = removable media / baiting. 'Opened an attached invoice' = phishing email attachment.

Tip 8: The exam prefers the MOST specific correct answer. If both 'malware' and 'Trojan horse' are options and the scenario describes disguised software, choose Trojan horse. If both 'logic bomb' and 'time bomb' are offered and the trigger is a date, choose time bomb.

Tip 9: Remember that ACFE frames malware as a fraud enabler. Questions may ask what the attacker ultimately gained (credentials, wire transfer, extortion payment) or which control would best have prevented the scheme. Match the control to the vehicle: patching stops worms and drive-bys; training and email filtering stop phishing; backups neutralize ransomware; separation of duties and code review deter logic bombs.

Tip 10: Do not confuse the vehicle with the type. Phishing is a vehicle, not a malware type. A Trojan is a type, not a vehicle. A question may describe a Trojan (type) delivered through a phishing email (vehicle); be clear which one is being asked about.

Tip 11: Eliminate distractors using absolutes. Statements such as 'Trojans self-replicate', 'worms require a host file', or 'viruses spread without any user action' are false and are common wrong answers in true/false style items.

Tip 12: Insider involvement is a strong clue. Logic bombs, backdoors, and hardware keyloggers are the malware types most associated with insiders. External attackers are more associated with worms, ransomware, botnets, and phishing-delivered Trojans.

9. Practice Scenarios

Scenario A: An accounts payable clerk opens an email attachment labeled as a vendor invoice. The file installs software that silently records her online banking login, which is later used to initiate fraudulent transfers. Type: keylogger (spyware) delivered as a Trojan. Vehicle: phishing email attachment.

Scenario B: Within hours, hundreds of unpatched servers across a company's offices are infected without any employee opening a file. Type: worm. Vehicle: network propagation exploiting an unpatched vulnerability.

Scenario C: Three months after a database administrator is fired, the payroll database is wiped on the first day of the quarter. Type: logic bomb (specifically a time bomb). Vehicle: insider installation using authorized access.

Scenario D: Employees' files are suddenly encrypted and a message demands cryptocurrency, threatening to publish stolen customer data. Type: ransomware with double extortion. Best preventive control: offline tested backups combined with phishing defenses and patching.

Scenario E: Several executives are infected after visiting an industry association website that had been secretly compromised. Vehicle: watering hole attack (a targeted drive-by download).

10. Final Summary

For the CFE exam, master the definitions of each malware type, the two-question test (host required? user action required?), the delivery vehicles and the clue words that identify them, and the controls that match each threat. Approach every question by first identifying whether it asks about a type, a vehicle, or a control, then select the most specific accurate answer. With this framework, malware questions become some of the most predictable points on the exam.