Knowing what malware is won’t necessarily prepare you for how these attacks happen in real-life situations and environments. Seeing how other companies fell victim to crafty threat actors and devious cybercriminals will help you understand different vulnerabilities, so when you do eventually encounter a threat, you’ll be better equipped to stop it in its tracks.
The most common types of malware are ransomware, trojans, and fileless attacks. Most hackers use one or more of these tactics to create vulnerabilities and exploit them.
Here are a few well-known examples of malicious software that helped them do just that.
In May 2017, the WannaCry cryptoworm—a dangerous combination of data-encrypting ransomware with a self-replicating computer worm—infected over 230,000 Windows devices using an exploit called EternalBlue that allowed hackers to gain access to all computers connected to a network. Since Microsoft had patched the exploit multiple times, they believed it to be obsolete. But anyone who hadn’t kept up with security updates was vulnerable.
Luckily, a British computer researcher named Marcus Hutchins found an online “kill switch” that stopped the spread. We tip our hats to you, Mr. Hutchins.
Ryuk was another particularly virulent strain of ransomware that plagued school systems, consulting firms, and even newspaper publishers like the Los Angeles Times. The malicious program encrypted data, with ransomers then demanding large amounts of Bitcoin to release infected files. It wasn’t shut down until someone found the manually controlled script that made it work.
Now that defenders better understand Ryuk’s tradecraft, managed security information and event management (SIEM) solutions like Huntress Managed SIEM can use log correlation and detections on suspicious infrastructure and behavior to surface early signs of an attack so you can shut it down fast.
Emotet is a backdoor program that lets in ransomware and other malicious software. It first cropped up in 2014 as banking malware designed to steal sensitive information stored on computers. Like a bad penny, Emotet keeps coming back, a little different every time. Nowadays, it can even detect when it’s in a virtual sandbox and lay dormant to fool scans.
The one thing that hasn’t changed is how it’s delivered: It’s always sent in phishing emails that goad users into clicking a link or opening an attachment. It’s yet another reminder of the importance of Security Awareness Training (SAT), which educates employees on common vulnerabilities and hacking techniques and how they can do their part to avoid them.
TrickBot
TrickBot is a persistent pest that’s been opening doors for malware attacks since 2016. Its original purpose was gathering financial data, but it’s since evolved into a malware-as-a-service access point that serves victims’ systems up on a platter.
Thankfully, managed endpoint detection and response (EDR) and Managed SIEM can surface the malicious process behavior, credential theft attempts, and other suspicious activity TricBot relies on, so your team and the Huntress SOC can respond quickly.
Fileless and living-off-the-land attacks are a common type of malware that uses your own scripts and endpoints against you. Since 2021, Volt Typhoon attacks have plagued critical infrastructure in Guam and elsewhere in the U.S. ever since, especially organizations relying on poorly secured endpoints. Once hackers gain access, they move quietly, archiving files and staging them for later removal.
Since they use valid credentials, the access appears authentic, making these stealthy, slow-moving attacks tough to spot. To detect them, you have to switch from thinking about file protection to identity protection, ensuring hackers never get hold of credentials in the first place.
Managed identity threat detection and response (ITDR) and endpoint security posture management (ESPM) are the best ways to detect vulnerabilities and defend against the rogue apps that make these living-off-the-land attacks work.
Sometimes, attackers use benign tools to run malicious attacks. Platforms like this are called “traitorware.” Splunk is one tool that’s capable of running living-off-the-land attacks despite not being designed for it.
Splunk’s main purpose is analyzing large amounts of data across environments. It lets users customize their configuration files, so they can define where the system sends data logs. Bad actors could set up a malicious server, create new configurations, and ship logs to their server undetected. The trick is in the layers: Security teams will likely notice someone editing existing files, but new ones get buried quickly.
There are several ways to prevent this from happening, including segmenting the network, using randomly generated admin passwords, and limiting outgoing traffic.
Knowing common attack patterns is key to spotting incidents early and evicting threat actors and their tools before they can do serious damage.
Let’s take a look at a few of the easiest attack patterns to identify.
Backdoors, phishing attacks, and compromised credentials leave traces in your environment. Use Managed SIEM to surface suspicious authentication and access events in log data, and Huntress Managed EDR to spot unusual endpoint behavior tied to that initial access.
While an attacker might gain access through a low-level account, they won’t stay down there—hackers will steadily escalate their privileges through social engineering or by injecting malicious code. Reduce the blast radius of compromised accounts with Huntress Managed ITDR and strong identity security posture controls (such as Managed ISPM), which help surface risky configuration changes and suspicious identity activity before attackers can turn low-level access into domain-wide control.
Once attackers have a foothold, they move laterally—pivoting to new hosts, abusing legitimate tools, and setting up persistence so they survive reboots. Huntress Managed EDR helps detect this post-compromise activity on endpoints, while Managed SIEM adds the broader log context you need to understand how far the attack has spread and where it started. With Huntress Managed Response, our SOC can actively contain confirmed threats, remove attacker persistence, and guide your team through endpoint and identity remediation.
Ideally, no attack ever progresses to the point where hackers encrypt files for ransom or leak sensitive data. If an incident does make it this far, you’ll need to activate your incident response plan and execute it quickly—from containing affected systems and accounts, to coordinating with incident response partners and beginning recovery.
You can learn a lot from past malware and incident examples, but attackers constantly adapt. Huntress Managed SIEM combines centralized log collection with Smart Filtering and our 24/7 SOC, so we monitor, correlate, and investigate security-relevant events across your environment—cutting down alert fatigue and helping your team catch early signs of malware or lateral movement that might otherwise be missed.
With a team of 24/7 security operations center (SOC) experts monitoring and cross-referencing log data, Huntress’ Managed SIEM keeps you one step ahead of dirty-dealing tactics by filtering for attack signals. This helps you avoid the attack fatigue that causes teams to miss early malware warning signs.
Learning about the top malware threats and from real attack examples is the best way to learn how to close gaps in your cybersecurity defenses. Not only will you pick up on signals to look out for, but you can also see how seemingly disconnected vulnerabilities could leave the door open for a sophisticated attack.
The Huntress SOC pairs Smart Filtering with 24/7 human-led analysis, so detections are validated before they reach your queue and you only see incidents that reflect real risk. Our analysts use experience from real-world tradecraft across millions of events to distinguish genuine attack activity from benign noise. When you’re ready to add managed SIEM and a 24/7 SOC to your stack, explore Huntress Managed SIEM and request a demo.
When you’re ready for the peace of mind that comes with a top-notch managed SOC at affordable prices, check out our Managed SIEM solution and schedule a free demo.
Several of the most dangerous malware attacks in history have been state-sponsored attacks against opposing nations. The Stuxnet attack of 2010, for example, earned its reputation as the first cyberattack to deal physical damage. It caused centrifuges at an Iranian nuclear facility to spin out of control.
Named malware attacks from private hacking groups, like the ILOVEYOU (or Love Bug) attack in 2000 and the WannaCry attack of 2017, were widespread enough to make the news but were ultimately short-lived and underwhelming. Private threat actors might get a moment in the spotlight now and then, but their attacks pale in comparison to the depth and scale of military cyber operations.
Fileless malware threats, also called living-off-the-land attacks, use your own scripts and executables rather than injecting new ones. Hackers manipulate scripts by giving them new targets or commands. A script or program that has been hijacked this way retains its authorization and firewall privileges, so scans and antivirus tools are none the wiser.
SIEM involves centralizing and analyzing log data to identify signals that EDR might miss. Many of the traces that malware attacks leave behind are subtle, and some, like TrickBot, even scrub the evidence on their way in. Log data is often the only evidence left, and it takes a sophisticated tool set and a team of knowledgeable professionals to sift through it.
