Ransomware and malware are two terms that are sometimes used interchangeably, but there are differences. Malware, short for malicious software, is an umbrella term that includes ransomware. That means that all ransomware is malware — but not all malware is ransomware.
An even broader umbrella term is threatware, which refers to malicious programs and includes malware, spyware, ransomware, worms, and keyloggers.
Let’s delve deeper into the nuances of these two types of cyberattacks.
Malware describes all types of malicious software. Malware examples include:
Trojan horse. Malicious code or software that acts like a legitimate application or file, tricking users into executing malware on their device.
Cryptojacking. The unauthorized use of someone else’s computer to mine cryptocurrency. This can be done via phishing or by infecting a website with JavaScript code that auto-executes on a computer.
Virus. A type of malware that is designed to spread from one computer to another.
Rootkits. A type of malware that is designed to give access to an otherwise unauthorized area of a computer.
Spam bots. Bots are simply applications designed to perform repetitive tasks. Bots fall into the malware category when they perform malicious tasks, like direct web traffic as a part of a DDoS attack or spread spam.
Worms. A standalone malware program that replicates itself to spread to other systems.
Adware. Software that displays banner advertisements while running.
Spyware. Any software designed to gather user information without their knowledge.
Ransomware
Software is defined as malware when it is intended to create damage to a computer, network or server. Systems can be infected with malware when users visit suspicious websites or download unreliable applications. Threat actors can also manually install malware onto a user’s computer or network by gaining physical access to the computer or by using techniques such as privilege escalation to obtain remote administrator access and move laterally throughout the network.
Since malware is defined as malicious software, the difference between malware and malicious code is subtle. Malicious code can also include website scripts that exploit vulnerabilities to then upload malware.
Is malware dangerous? Some forms of malware are more dangerous than others. Adware, for example, is detrimental to the user experience and can result in a slower computer but is otherwise relatively innocuous. Other types of malware, such as ransomware, are extremely dangerous.
Ransomware is a type of malware in which a threat actor encrypts a victim’s files and systems and demands payment in exchange for access to those files. Sometimes threat actors will disguise themselves as a government agency or other authority, claiming that the system is locked down for security reasons.
Threat actors can launch and execute ransomware attacks in a variety of ways. Phishing is one of the more common ways, or when a user clicks a suspicious link or attachment. These can often be in the form of social engineering attacks in which threat actors disguise themselves as legitimate corporations or colleagues.
Other stages in a ransomware attack include escalating privileges to gain domain or admin account permissions, executing files, exfiltrating data, and finally, deploying the ransomware and demanding payment.
There are a few differences between ransomware and malware, which we highlighted in the chart below:
| Ransomware | Malware | |
|---|---|---|
| Delivery method |
Malicious attachments via phishing emails | Links, emails, app installations, suspicious websites, USB |
| Ease of removal | Extremely difficult; victims must either pay the ransom or restore from known backup |
Moderate; antivirus software can usually remove an infection |
| Variety | Limited; the only two types of ransomware are crypto and locker |
Includes all types of malicious software, including trojan horses, viruses, etc. |
| Impact |
The impact of ransomware is often severe and long-lasting. Many businesses have shut down operations due to ransomware attacks. |
Commodity malware can control data and resources; reduce system performance; but it generally doesn’t destroy a business |
The difference between malware and a virus is similar to the difference between malware and ransomware; malware is an umbrella term for all types of malicious software, and a virus is a specific type of malware that modifies other programs by inserting its code, self-replicating and spreading to different systems.
There are few types of computer viruses. Some examples are:
Macro virus. Applications like Microsoft Word and Excel use macro languages to automatically run when documents are opened, and macro viruses are written in the same language. These viruses run on applications (typically Word and Excel) and spread when a user opens or closes an infected document.
Boot sector virus. Boot sector viruses run during a computer’s startup. These viruses infect the storage sector that contains startup files, or the boot sector.
Polymorphic virus. A polymorphic virus creates modified versions of itself by encrypting its code and using different encryption keys after every infection to evade detection.
Web scripting virus. One of the most common viruses, a web scripting virus uses a client code script to breach browser security. Its major methods of spreading include pop-up and webpage ads.
Browser hijacker. This virus modifies a web browser’s settings without the user’s permission to place unwanted ads into the browser.
File-infecting virus. File-infecting viruses, also known as file infectors, inject their code into executable programs, like .COM and .EXE files.
In our webinar with Blumira’s Mike Behrmann, Director of Security and Erica Mixon, Content Marketing Manager, you can learn more about malware vs ransomware, as well as how to develop a comprehensive incident response plan for malware infections. Watch it on demand.
