Common Threats: Malware, Ransomware and More | Free Cybersecurity Course: Protect Your Data, Devices and Business

What you'll learn

The main types of malware (viruses, worms, trojans, spyware, infostealers, ransomware) and how to tell them apart.
Threats that aren't malware at all: credential stuffing, business email compromise, DDoS, insiders and supply chain attacks.
How a typical ransomware attack unfolds, stage by stage, and where defenders can stop it.
Why tested offline backups beat paying a ransom, with real numbers.
The warning signs that a device may be infected and what to do first.

Most cyberattacks are not movie-style break-ins. They're repeatable business models: criminals send millions of messages, scan the internet for unpatched systems and reuse passwords leaked from old breaches, all with automated tools. If you understand the handful of techniques they rely on, you can recognize them early and know which defenses actually matter. This lesson covers the most common threats, with a closer look at ransomware, the attack that can shut down a small business overnight.

48%of breaches in Verizon's 2026 DBIR involved ransomware, up from 44% the year before

31%of breaches began with exploitation of a vulnerability, now the top way in according to the same report

69%of ransomware victims in the 2026 DBIR did not pay the ransom

Know who attacks and why
Tell malware types apart
Spot non-malware threats
Understand ransomware
Prepare your defenses

Who attacks, and why

Knowing the motive helps you predict the attack. Most small businesses and individuals face the first group far more often than the others.

Cybercriminals

Motivated by money. They run ransomware, steal login credentials to sell, and send fake invoices.

What they want from you: payments, data they can resell, or access they can rent to other criminals.

Nation-state groups

Government-backed teams after intelligence, intellectual property or disruption of critical infrastructure.

Why it matters to small firms: suppliers and contractors are sometimes used as a stepping stone to bigger targets.

Hacktivists

Driven by a political or social cause. They deface websites, leak documents or flood sites with traffic.

Typical targets: organizations in the news or tied to a controversial issue.

Insiders

Employees, contractors or partners. Some act on purpose; many more cause harm by accident.

Best defense: least privilege, prompt removal of access when people leave, and logs of who did what.

Malware: the main families

Malware (malicious software) is any program designed to harm, spy on or take control of a device. The names describe how it spreads or what it does, and a single piece of malware often combines several behaviors.

Type	How it spreads or works	What it does	Main defense
Virus	Attaches to a file or program and runs when you open it	Corrupts files, installs other malware	Updates, endpoint protection, caution with attachments
Worm	Spreads on its own across networks by exploiting unpatched flaws	Infects many machines quickly	Patching, firewalls, network segmentation
Trojan	Disguised as something useful: a "free" app, a cracked game, a fake update	Opens a hidden door for attackers	Install software only from official sources
Spyware and infostealers	Usually arrive through trojans or malicious downloads	Steal saved passwords, browser cookies, crypto wallets	Password manager instead of browser-saved passwords, MFA, endpoint protection
Adware	Bundled with free software	Floods you with ads, may track browsing	Careful installs, remove unknown extensions
Rootkit	Hides deep in the operating system	Conceals other malware from security tools	Secure boot, updates, reinstall from clean media if found
Botnet agent	Installed by other malware	Turns your device into a "zombie" used for spam or attacks	Change default passwords on routers and smart devices, update firmware
Ransomware	Usually deployed by humans after they break in	Encrypts files and often steals them first, then demands payment	Offline tested backups, MFA, patching, least privilege

1. What is the key difference between a worm and a virus?

A worm only affects phones; a virus only affects computers
A worm spreads by itself across networks; a virus needs a person to open an infected file or program
A virus encrypts files; a worm never causes damage

Worms self-propagate, usually by exploiting unpatched flaws, which is why they can spread through a whole network in minutes. That's also why patching is the main defense against them.

Threats that aren't malware

Some of the most expensive attacks involve no malicious software at all. They abuse trust, passwords and normal features.

Credential stuffing: criminals take username and password pairs leaked from one site and try them automatically on hundreds of others. It works because people reuse passwords. Unique passwords plus MFA (lesson 4) shut it down.
Business email compromise (BEC): a criminal impersonates, or takes over, a boss, supplier or client's email account and asks for a payment or a change of bank details. You'll study it in depth in lesson 3.
Denial of service (DoS/DDoS): a site or service is flooded with traffic until it stops responding. For small sites, the main defense is a hosting provider or content delivery network with built-in DDoS protection.
Vulnerability exploitation: attackers scan the internet for systems with known, unpatched flaws, especially VPNs, firewalls and remote access tools at the edge of the network. Fast patching of internet-facing systems is the defense.
Supply chain and third-party attacks: instead of attacking you directly, criminals compromise a software vendor, IT provider or contractor you trust. The 2026 DBIR found third parties involved in nearly half of breaches.
Insider misuse and mistakes: a departing employee downloads the customer list, or someone emails a spreadsheet of Social Security numbers to the wrong person.

Here's how often some of these factors showed up in breaches studied by Verizon's 2026 Data Breach Investigations Report. A single breach can involve several factors, so the bars don't add up to 100%:

Share of breaches involving each factor (Verizon DBIR 2026)

Human element62%

Ransomware48%

Third party involved48%

Exploited vulnerability (way in)31%

Stolen credentials (way in)13%

Ransomware up close

Modern ransomware is rarely a single click that instantly locks a computer. It's usually an operation run by people over days or weeks. Many groups use double extortion: they copy your data first, then encrypt it, and threaten to publish what they stole if you don't pay. That's why backups alone don't solve everything; they fix availability but not confidentiality.

Understanding the stages tells you where you have chances to stop it:

Stage 1Initial accessA phishing email, a reused password on a remote access portal or an unpatched VPN. Defense: MFA, patching, training.
Stage 2Exploring and spreadingAttackers look for admin accounts, file servers and backups. Defense: least privilege, separate admin accounts, segmentation, alerts on new admin accounts.
Stage 3Stealing dataLarge amounts of data are copied out. Defense: monitoring of unusual uploads, encryption, keeping less data.
Stage 4Encryption and ransom noteFiles and sometimes backups are encrypted. Defense: offline or immutable backups, endpoint protection that detects mass encryption.
Stage 5RecoveryVictims restore, rebuild or negotiate. Defense: an incident response plan, tested restores, early reporting to law enforcement.

Should you ever pay?

The FBI discourages paying ransoms: payment doesn't guarantee you'll get a working decryption key or that stolen data will be deleted, and it funds more attacks. If you're hit, report it to the FBI (ic3.gov or your local field office) or CISA, and talk to your cyber insurer and a lawyer before making any decision. The real answer is to prepare so you never have to consider it.

2. A ransomware group encrypts a clinic's files and also threatens to publish patient data unless it pays. What is this tactic called?

Credential stuffing
A worm
Double extortion

Double extortion combines encryption (an availability attack) with data theft (a confidentiality attack). Backups let you restore, but they don't undo the leak, which is why preventing initial access and limiting data matter too.

Real-world case: a landscaping company in Austin

Green Mesa Landscaping, 22 employeesAustin, Texas · scheduling, billing and payroll on four office PCs and a small server (a fictional example)

Criminals logged into the office's remote access tool with a password the owner had reused on a site that was breached years earlier. There was no MFA. Over a weekend they encrypted the server and demanded $85,000. Green Mesa didn't pay: its IT contractor had set up a nightly backup to a drive that was disconnected after each run. The company was back to work in two days. Afterward, it closed the gaps that let the attackers in.

Before

Accounts with MFA20%

PCs patched within 14 days55%

Critical data in offline backup70%

After

Accounts with MFA100%

PCs patched within 14 days95%

Critical data in offline backup100%

Total cost: $17,800 instead of a $85,000 ransom plus weeks of disruption.

Here's how the numbers break down. The company estimates each day without its systems costs $6,500 in lost billable work and overtime:

Scenario	Calculation	Cost
What happened (offline backup)	2 days × $6,500 + $4,800 IT recovery	$17,800
Without a usable backup, paying the ransom	$85,000 + 10 days × $6,500 + $4,800 IT recovery	$154,800

Even in the second scenario, nothing guarantees that the decryption tool works or that the stolen data is deleted. The backup was the difference between a bad week and a crisis. Notice too that 30% of the critical data was not in the offline backup before the incident; the company was partly lucky. Lesson 7 shows you how to build a backup plan that doesn't depend on luck.

3. Which measure best limits the damage if ransomware encrypts every computer on your network?

Recent backups stored offline and tested by actually restoring files
A longer Wi-Fi password
A cloud folder that syncs every change automatically

CISA's #StopRansomware Guide recommends offline, encrypted backups that are tested regularly. A sync folder replicates the encrypted files too, so it isn't a backup on its own.

Warning signs and first steps

Not every slow computer is infected, but these signs deserve attention:

Files with strange new extensions or a text file with payment instructions.
Security software turned off and you didn't do it.
New browser extensions, toolbars or a changed home page.
Friends receiving messages "from you" that you didn't send.
Password-reset or new-login alerts you didn't trigger.
The fan running hard and the device sluggish when nothing is open.

If you suspect an infection: disconnect the device from the network (unplug the cable or turn off Wi-Fi), don't log into sensitive accounts from it, and use a different, clean device to change your important passwords. At work, call IT or your security contact right away, even if you think it was "your fault." Reporting fast matters far more than blame. You'll learn the full response process in lesson 14.

Common mistakes

"I have antivirus, so I'm covered."

Endpoint protection is one layer. Ransomware crews often use stolen passwords and legitimate tools that antivirus doesn't flag.

Keeping the backup drive plugged in all the time.

Disconnect it after each backup, or use a service with immutable, versioned copies.

Downloading "free" versions of paid software.

Install only from official stores and vendor websites. Cracked software is a favorite trojan delivery method.

Leaving remote access tools open to the internet with just a password.

Put them behind MFA and a VPN, or turn them off when not in use.

4. A Tucson print shop loses $3,200 per day when its systems are down. Recovery takes 4 days and the IT provider bills $2,500. What is the total cost?

$12,800
$15,300
$5,700

4 × $3,200 = $12,800 of downtime, plus $2,500 for recovery, equals $15,300. Comparing this number with the cost of better backups and faster restores is how you justify the investment.

Practice exercise

For each situation, name the most likely threat and the first defensive action:

Your bookkeeper gets a login alert from Oregon for her payroll account. She lives in Georgia and reuses the same password on several sites.
An employee installed a "free PDF editor" from a pop-up ad. Since then, the browser keeps opening casino websites.
Every PC in the office shows files renamed with an odd extension and a note demanding payment in cryptocurrency.
Your online store goes offline every evening during a sale; your host reports a flood of traffic from thousands of addresses.
A former sales rep, who left on bad terms, can still log into the customer database two weeks later.

See solution

1. Credential stuffing. Change that password from a clean device, make every password unique and turn on MFA, starting with email and payroll.
2. Trojan with adware. Disconnect from the network, uninstall the program and unknown extensions, run a full scan and have IT check the machine. Restrict software installs to approved sources.
3. Ransomware. Isolate the affected machines from the network immediately, call your IT provider or incident response contact, report to the FBI or CISA and restore from offline backups once the attackers are out.
4. DDoS attack. Turn on the DDoS protection offered by your host or a content delivery network, and have a plan for sales events.
5. Insider risk (an offboarding failure). Disable the account now, review what it accessed and add "remove all access on the last day" to your offboarding checklist.

Summary

Most attackers are criminals after money, using automated, repeatable techniques.
Malware types differ in how they spread: viruses need you, worms spread alone, trojans pretend to be useful.
Some of the costliest threats use no malware: credential stuffing, business email compromise and exploitation of unpatched systems.
Ransomware unfolds in stages, and each stage has a defense: MFA, patching, least privilege, monitoring and offline backups.
Tested offline backups turn a potential six-figure crisis into a manageable recovery.

Next lesson: Phishing and Social Engineering: How to Spot Them. You'll learn the psychological tricks behind phishing, the red flags in emails, texts and calls, and a simple routine to verify before you click or pay.