# Malware family reference > Organised by what each category does, not by whichever campaign is in > the news. Behaviour is what defences map to, and behaviour is stable. **Not a threat feed.** Named examples are illustrative and may since have been disrupted, rebranded or superseded. Treat them as a sense of the category, not as a current threat feed. The categories and the defences are the stable part. ## Ransomware Also called: Crypto-extortion, double extortion Status: active Encrypts files and demands payment for the key. Almost every current operation steals the data first and threatens to publish it, so recovery from backup no longer ends the incident. **How it spreads.** Bought credentials, unpatched internet-facing appliances, and access resold by initial access brokers. Rarely a direct email these days. **Why it matters in Australia.** Paying can itself trigger a reporting obligation, and stolen personal information can trigger the notifiable data breaches scheme whether you paid or not. Both turn on facts about the entity, so check ASD and the OAIC for the current position rather than relying on a figure quoted here. **What reduces the risk.** - Offline or immutable backups a compromised admin account cannot reach - Phishing-resistant MFA on VPN and administrative accounts - Patch internet-facing systems within days **Examples seen in the wild.** LockBit, Akira, Qilin, BlackCat/ALPHV, Cl0p Read more: https://www.malware.com.au/ransomware/ ## Infostealers Also called: Stealers, credential stealers Status: active Runs once, sweeps the machine for browser passwords, session cookies, crypto wallets and VPN configs, exfiltrates, and often deletes itself. **How it spreads.** Cracked software, fake installers promoted through search ads, malicious browser extensions, and "update your driver" lures. **Why it matters in Australia.** Stolen session cookies bypass MFA entirely, because the attacker resumes an already-authenticated session. This is now a leading route into Australian corporate email and therefore into invoice fraud. **What reduces the risk.** - Short session lifetimes and revoke sessions on password reset - Application control, and block installs from outside managed channels - Monitor your domain on Have I Been Pwned **Examples seen in the wild.** Lumma, RedLine, Vidar, Raccoon, StealC Read more: https://www.malware.com.au/types-of-malware/ ## Loaders and droppers Also called: Access brokers, botnet loaders Status: active Establishes a foothold and fetches whatever the operator sells next. The payload is chosen after the fact, which is why a loader detection is never minor. **How it spreads.** Malicious attachments, container and shortcut files, and malvertising. **Why it matters in Australia.** A loader alert dismissed as trivial is frequently the first visible sign of an intrusion that becomes ransomware months later. **What reduces the risk.** - Treat every loader detection as an intrusion, not a cleanup - Block macros and inspect container file types at the gateway - Hunt for persistence after any detection **Examples seen in the wild.** Emotet, QakBot, IcedID, Latrodectus, Pikabot Read more: https://www.malware.com.au/types-of-malware/ ## Remote access trojans Also called: RATs, backdoors Status: active Gives an operator hands-on control: file access, keylogging, screen and webcam capture, and a base for moving deeper into the network. **How it spreads.** Phishing attachments, cracked software, and malicious remote support tools installed by a caller impersonating IT. **Why it matters in Australia.** The defining harm is dwell time. An operator watching for weeks learns your payment approvals and your org chart before acting. **What reduces the risk.** - Egress monitoring and alerting on unfamiliar outbound connections - Application control on servers and high-value workstations - Remove local administrator rights **Examples seen in the wild.** AsyncRAT, Remcos, NjRAT, Quasar Read more: https://www.malware.com.au/types-of-malware/ ## Phishing and relay kits Also called: Adversary-in-the-middle, AiTM Status: active Not malware on your machine at all. A proxy sits between the victim and the real login page, relaying credentials and one-time codes in real time and capturing the resulting session token. **How it spreads.** Convincing login pages reached through email, SMS or search ads. **Why it matters in Australia.** This is the mechanism behind most Australian business email compromise. It defeats every code-based MFA method, which is why phishing-resistant factors matter rather than MFA in general. **What reduces the risk.** - FIDO2 keys or passkeys, which fail closed against a lookalike domain - Conditional access on device compliance - Callback verification on any change to bank details **Examples seen in the wild.** Evilginx, Tycoon, EvilProxy Read more: https://www.malware.com.au/multi-factor-authentication/ ## Banking trojans Also called: Bankers Status: declining Intercepts or manipulates online banking sessions, historically by injecting fields into the page to harvest credentials and defeat one-time codes. **How it spreads.** Email attachments and malicious downloads, and increasingly as a secondary payload delivered by a loader. **Why it matters in Australia.** Largely displaced by infostealers and relay kits, which are cheaper to run and work against more targets. Worth knowing as the ancestor of both. **What reduces the risk.** - Phishing-resistant MFA on banking and payment systems - Dual authorisation above a payment threshold **Examples seen in the wild.** TrickBot, Ursnif/Gozi, Dridex Read more: https://www.malware.com.au/business-email-compromise/ ## Mobile malware Also called: Android banking malware, smishing droppers Status: active Abuses accessibility services to overlay fake login screens, read SMS one-time codes and, in the worst cases, operate the device remotely. **How it spreads.** SMS lures about parcels or fines, sideloaded apps, and dropper apps that pass store review then fetch the payload later. **Why it matters in Australia.** Australia has been hit hard by SMS-delivered campaigns, which land well here because parcel and toll notifications by text are normal. Never sideload, and treat any SMS link as hostile. **What reduces the risk.** - Never sideload; keep Play Protect or equivalent enabled - Never grant accessibility permissions to a messaging or delivery app - Prefer passkeys over SMS codes **Examples seen in the wild.** Anatsa/TeaBot, FluBot, Cerberus, Hook Read more: https://www.malware.com.au/multi-factor-authentication/ ## Wipers Also called: Destructive malware Status: active Destroys data irrecoverably. Often disguised with a ransom note, but no key exists. Used for sabotage or to destroy evidence. **How it spreads.** Usually after a long intrusion, deployed with the same access used for reconnaissance. **Why it matters in Australia.** Rare against Australian commercial targets, but the reason backups must be offline and restore-tested rather than merely present. **What reduces the risk.** - Offline, immutable, restore-tested backups - Network segmentation to limit blast radius **Examples seen in the wild.** NotPetya, HermeticWiper, WhisperGate Read more: https://www.malware.com.au/ransomware/ ## Cryptominers Also called: Cryptojacking Status: active Consumes your CPU, GPU or cloud compute to mine cryptocurrency for someone else. Financially minor in itself. **How it spreads.** Exposed container and orchestration APIs, unpatched servers, and stolen cloud credentials. **Why it matters in Australia.** Treat every miner as an incident, not a nuisance. It proves someone could execute arbitrary code on that host, and the next payload need not be harmless. On cloud, the bill is often the first symptom. **What reduces the risk.** - Alert on sustained CPU and unexpected cloud spend - Never expose container or orchestration APIs to the internet **Examples seen in the wild.** XMRig-based campaigns, Kinsing Read more: https://www.malware.com.au/types-of-malware/ ## Rootkits and bootkits Also called: Firmware implants Status: active Runs beneath or before the operating system, so the tools looking for it are already compromised by the time they run. **How it spreads.** Post-compromise, usually requiring administrative access already obtained by other means. **Why it matters in Australia.** Rare and hard to detect from within the running system. A machine suspected of firmware compromise should be treated as unrecoverable, not cleaned. **What reduces the risk.** - Secure Boot and measured boot, with firmware kept patched - Replace rather than clean a suspected firmware compromise **Examples seen in the wild.** BlackLotus, CosmicStrand Read more: https://www.malware.com.au/types-of-malware/ ## Stalkerware Also called: Spouseware, monitoring apps Status: active Commercial monitoring apps installed by someone with physical access to a victim's phone, reporting messages, calls and location. **How it spreads.** Installed directly by a partner, family member or employer, not by a remote attacker. **Why it matters in Australia.** A safety problem before it is a technical one, and removing the app can escalate risk. In Australia, 1800RESPECT (1800 737 732) and IDCARE (1800 595 160) can help. Plan before acting. **What reduces the risk.** - Seek support before removing anything - Review device admin and accessibility permissions from a safe device **Examples seen in the wild.** mSpy, FlexiSpy, Cerberus app Read more: https://www.malware.com.au/types-of-malware/ --- General information only, not legal advice. https://www.malware.com.au/malware-families/