Malware, viruses, worms, trojans, rootkits and botnets
Learn how common types of malicious software differ, what a botnet is, and how to respond to a suspected infection.
Malware, short for malicious software, is software or firmware intended to perform unauthorized harmful actions. It can steal data, disrupt operations or help an attacker maintain access. Malicious code is a related term used in [NIST’s malware glossary](https://csrc.nist.gov/glossary/term/malware). The examples below are categories, not mutually exclusive labels: one incident can involve several capabilities.
## Virus, worm and trojan
A computer virus spreads by adding a copy of itself to another program or file; executing the infected host can execute the virus. A worm is self-replicating malware that can spread between systems without needing to attach to a host program. The details of propagation vary. [NIST defines viruses](https://csrc.nist.gov/glossary/term/virus) and [worms](https://csrc.nist.gov/glossary/term/worm).
A trojan horse is a program that appears useful or harmless while containing hidden malicious functionality. It describes deception, not necessarily self-replication. See the [NIST trojan horse definition](https://csrc.nist.gov/glossary/term/trojan_horse). Ransomware is malware that can deny access to systems or data while an attacker demands payment; see [our ransomware guide](https://blog.mithril.fund/what-is-ransomware?lang=en).
## Rootkits and botnets
A rootkit is a collection of software components that changes host behavior in a stealthy, malicious way. It can conceal processes, files or attacker activity; its presence can make ordinary observations less reliable. [NIST’s rootkit glossary](https://csrc.nist.gov/glossary/term/rootkit) describes the term.
A botnet is a group of compromised internet-connected devices that an attacker can coordinate. It is a network of affected devices rather than a synonym for one specific malware family. Some botnets conduct distributed denial-of-service (DDoS) attacks, flooding a target from multiple sources; others may be used for different purposes. Not every DDoS attack uses a botnet. [CISA, FBI and MS-ISAC guidance](https://www.cisa.gov/sites/default/files/2024-03/understanding-and-responding-to-distributed-denial-of-service-attacks_508c.pdf) explains distributed attacks.
## Reduce exposure and respond
Keep software updated, limit unnecessary privileges, protect accounts with phishing-resistant authentication where practical, and maintain tested, isolated backups. Monitoring and endpoint security can help identify suspicious activity but cannot guarantee that every infection will be detected.
For a suspected incident, follow the organization’s incident plan: coordinate isolation of affected systems to limit harm, preserve relevant evidence, determine scope, remove the cause and restore from verified backups where appropriate. Seek qualified assistance if needed, particularly for critical systems; indiscriminate cleanup can destroy evidence or interrupt operations. Check recovered systems and account access before returning them to service. See [Mithril’s security operations guide](https://blog.mithril.fund/siem-soar-edr-xdr-explained?lang=en) for monitoring and response concepts. Sources reviewed on 2026-10-29.