Malware family reference
One entry per family, in a fixed shape: what it does, how it spreads, the Australian angle, current examples and the defences that work against it. Organised by behaviour rather than by whichever campaign is in the news, because behaviour is what defences map to and behaviour is stable for years.
Looking for the plain-language version instead? Types of malware, explained covers the same categories as a read-through, without the reference detail.
Not a threat feed
This moves fast. The named examples under each family are illustrative only, and any one of them may since have been disrupted, rebranded or superseded, so treat them as a sense of the category rather than a current threat feed. The categories themselves, and the defences against them, are the stable part.
Ransomware
ActiveAlso called: Crypto-extortion, double extortion
Encrypts files and demands payment for the key. Almost every current operation steals the data first and threatens to publish it, so recovery from backup no longer ends the incident.
- How it spreads
- Bought credentials, unpatched internet-facing appliances, and access resold by initial access brokers. Rarely a direct email these days.
- Why it matters in Australia
- Paying can itself trigger a reporting obligation, and stolen personal information can trigger the notifiable data breaches scheme whether you paid or not. Both turn on facts about the entity, so check ASD and the OAIC for the current position rather than relying on a figure quoted here.
- What reduces the risk
- Offline or immutable backups a compromised admin account cannot reach
- Phishing-resistant MFA on VPN and administrative accounts
- Patch internet-facing systems within days
- Examples seen in the wild
LockBitAkiraQilinBlackCat/ALPHVCl0p
Infostealers
ActiveAlso called: Stealers, credential stealers
Runs once, sweeps the machine for browser passwords, session cookies, crypto wallets and VPN configs, exfiltrates, and often deletes itself.
- How it spreads
- Cracked software, fake installers promoted through search ads, malicious browser extensions, and "update your driver" lures.
- Why it matters in Australia
- Stolen session cookies bypass MFA entirely, because the attacker resumes an already-authenticated session. This is now a leading route into Australian corporate email and therefore into invoice fraud.
- What reduces the risk
- Short session lifetimes and revoke sessions on password reset
- Application control, and block installs from outside managed channels
- Monitor your domain on Have I Been Pwned
- Examples seen in the wild
LummaRedLineVidarRaccoonStealC
Loaders and droppers
ActiveAlso called: Access brokers, botnet loaders
Establishes a foothold and fetches whatever the operator sells next. The payload is chosen after the fact, which is why a loader detection is never minor.
- How it spreads
- Malicious attachments, container and shortcut files, and malvertising.
- Why it matters in Australia
- A loader alert dismissed as trivial is frequently the first visible sign of an intrusion that becomes ransomware months later.
- What reduces the risk
- Treat every loader detection as an intrusion, not a cleanup
- Block macros and inspect container file types at the gateway
- Hunt for persistence after any detection
- Examples seen in the wild
EmotetQakBotIcedIDLatrodectusPikabot
Remote access trojans
ActiveAlso called: RATs, backdoors
Gives an operator hands-on control: file access, keylogging, screen and webcam capture, and a base for moving deeper into the network.
- How it spreads
- Phishing attachments, cracked software, and malicious remote support tools installed by a caller impersonating IT.
- Why it matters in Australia
- The defining harm is dwell time. An operator watching for weeks learns your payment approvals and your org chart before acting.
- What reduces the risk
- Egress monitoring and alerting on unfamiliar outbound connections
- Application control on servers and high-value workstations
- Remove local administrator rights
- Examples seen in the wild
AsyncRATRemcosNjRATQuasar
Phishing and relay kits
ActiveAlso called: Adversary-in-the-middle, AiTM
Not malware on your machine at all. A proxy sits between the victim and the real login page, relaying credentials and one-time codes in real time and capturing the resulting session token.
- How it spreads
- Convincing login pages reached through email, SMS or search ads.
- Why it matters in Australia
- This is the mechanism behind most Australian business email compromise. It defeats every code-based MFA method, which is why phishing-resistant factors matter rather than MFA in general.
- What reduces the risk
- FIDO2 keys or passkeys, which fail closed against a lookalike domain
- Conditional access on device compliance
- Callback verification on any change to bank details
- Examples seen in the wild
EvilginxTycoonEvilProxy
Banking trojans
DecliningAlso called: Bankers
Intercepts or manipulates online banking sessions, historically by injecting fields into the page to harvest credentials and defeat one-time codes.
- How it spreads
- Email attachments and malicious downloads, and increasingly as a secondary payload delivered by a loader.
- Why it matters in Australia
- Largely displaced by infostealers and relay kits, which are cheaper to run and work against more targets. Worth knowing as the ancestor of both.
- What reduces the risk
- Phishing-resistant MFA on banking and payment systems
- Dual authorisation above a payment threshold
- Examples seen in the wild
TrickBotUrsnif/GoziDridex
Mobile malware
ActiveAlso called: Android banking malware, smishing droppers
Abuses accessibility services to overlay fake login screens, read SMS one-time codes and, in the worst cases, operate the device remotely.
- How it spreads
- SMS lures about parcels or fines, sideloaded apps, and dropper apps that pass store review then fetch the payload later.
- Why it matters in Australia
- Australia has been hit hard by SMS-delivered campaigns, which land well here because parcel and toll notifications by text are normal. Never sideload, and treat any SMS link as hostile.
- What reduces the risk
- Never sideload; keep Play Protect or equivalent enabled
- Never grant accessibility permissions to a messaging or delivery app
- Prefer passkeys over SMS codes
- Examples seen in the wild
Anatsa/TeaBotFluBotCerberusHook
Wipers
ActiveAlso called: Destructive malware
Destroys data irrecoverably. Often disguised with a ransom note, but no key exists. Used for sabotage or to destroy evidence.
- How it spreads
- Usually after a long intrusion, deployed with the same access used for reconnaissance.
- Why it matters in Australia
- Rare against Australian commercial targets, but the reason backups must be offline and restore-tested rather than merely present.
- What reduces the risk
- Offline, immutable, restore-tested backups
- Network segmentation to limit blast radius
- Examples seen in the wild
NotPetyaHermeticWiperWhisperGate
Cryptominers
ActiveAlso called: Cryptojacking
Consumes your CPU, GPU or cloud compute to mine cryptocurrency for someone else. Financially minor in itself.
- How it spreads
- Exposed container and orchestration APIs, unpatched servers, and stolen cloud credentials.
- Why it matters in Australia
- Treat every miner as an incident, not a nuisance. It proves someone could execute arbitrary code on that host, and the next payload need not be harmless. On cloud, the bill is often the first symptom.
- What reduces the risk
- Alert on sustained CPU and unexpected cloud spend
- Never expose container or orchestration APIs to the internet
- Examples seen in the wild
XMRig-based campaignsKinsing
Rootkits and bootkits
ActiveAlso called: Firmware implants
Runs beneath or before the operating system, so the tools looking for it are already compromised by the time they run.
- How it spreads
- Post-compromise, usually requiring administrative access already obtained by other means.
- Why it matters in Australia
- Rare and hard to detect from within the running system. A machine suspected of firmware compromise should be treated as unrecoverable, not cleaned.
- What reduces the risk
- Secure Boot and measured boot, with firmware kept patched
- Replace rather than clean a suspected firmware compromise
- Examples seen in the wild
BlackLotusCosmicStrand
Stalkerware
ActiveAlso called: Spouseware, monitoring apps
Commercial monitoring apps installed by someone with physical access to a victim's phone, reporting messages, calls and location.
- How it spreads
- Installed directly by a partner, family member or employer, not by a remote attacker.
- Why it matters in Australia
- A safety problem before it is a technical one, and removing the app can escalate risk. In Australia, 1800RESPECT (1800 737 732) and IDCARE (1800 595 160) can help. Plan before acting.
- What reduces the risk
- Seek support before removing anything
- Review device admin and accessibility permissions from a safe device
- Examples seen in the wild
mSpyFlexiSpyCerberus app
Checking something specific?
The tools directory covers the free services for checking a file, link or address, and which of them publish whatever you upload. If an incident has already happened, start with reporting it to ASD.