From Viruses to Botnets: Malware’s Relentless Evolution

Malware is not one technology. It is an umbrella for software used to replicate, steal, control, sabotage, spy or extort. A virus attaches to another carrier and requires it to run. A worm spreads automatically. A trojan pretends to be desirable software. A bot joins a remotely controlled network. Ransomware blocks access to systems or data, often combining encryption with theft.

Those categories overlap. WannaCry was ransomware with worm capability, while a modern loader may be a trojan that installs an infostealer and later ransomware. Malware history is therefore an evolution of delivery, persistence, command-and-control and monetisation.

Timeline

Year	Example	Why it mattered
1971	Creeper / Reaper	Early network-moving code and a program that removed it
1983–1984	Cohen’s experiments	Formal virus definition and limits of defence
1986	Brain	Early PC boot-sector virus
1988	Morris worm	Multi-vector Internet propagation
1989	AIDS Trojan	Early digital extortion
2000	ILOVEYOU	Global spread through email and contacts
2003	SQL Slammer	Extreme worm speed
2008	Conficker	Multi-channel propagation and resilient botnet design
2010	Stuxnet	Industrial sabotage
2016	Mirai	IoT botnet built from default passwords
2017	WannaCry / NotPetya	Worm-like ransomware and destructive global impact

Creeper was not a modern virus

Creeper operated on TENEX systems connected to ARPANET in the early 1970s, moving between machines and displaying a message. Calling it the first virus without context erases the difference between an experimental network program and later file-infecting malware.

Reaper located and removed Creeper. It is an early example of automated response and an early trust problem: a defensive tool also needs permission to travel and change systems. Endpoint security does similar technical work under owner authority; a worm does it without permission.

Fred Cohen defines the virus

On 3 November 1983 Fred Cohen prepared an authorised Unix experiment. His program attached to others and gave them the capacity to spread infection. Leonard Adleman proposed the name “virus”; Cohen’s 1984 paper formalised the concept.

The deeper contribution was analysis of detection limits. There is no simple universal mechanism that settles every possible program. Antivirus was therefore never a complete answer. Signatures catch known samples, heuristics catch related behaviour and sandboxes observe execution. Attackers can transform representation, use legitimate tools or delay activity. Defence requires independent layers.

Boot sectors and removable media

PC viruses exploited floppy exchange and automatically executed boot code. Brain in 1986 infected floppy boot sectors, loading before the operating system. File infectors attached to executables, macro viruses used office documents, and polymorphic code changed or encrypted its body to defeat signatures. Each depended on a user or process launching an infected carrier.

The Morris worm: multi-vector propagation

The 1988 Morris worm exploited a fingerd buffer overflow, sendmail debug behaviour, trust relationships and password guessing. A small bootstrap retrieved platform-specific code. An imperfect attempt to avoid already infected hosts produced repeated copies and resource exhaustion.

RFC 1135 documents how Berkeley and MIT teams analysed samples, created fixes and shared information. Most infections were removed within 48–72 hours. CERT/CC was created in the aftermath, making the worm a milestone in the wider history of cybersecurity.

AIDS Trojan: extortion before cryptocurrency

The 1989 AIDS Information Introductory Diskette hid a trojan. After a number of boots, it concealed filenames and demanded payment. The mechanism was weaker than modern cryptographic ransomware, but the business pattern is recognisable: a lure, delayed execution, denied access and ransom demand. The wider cybersecurity timeline places the case in context.

It also illustrates the definition of a trojan. The program relies on false identity and user execution; it does not need to infect other files. Fake installers and updates use the same principle today.

ILOVEYOU: social engineering plus automation

In May 2000, an “ILOVEYOU” email carried a Visual Basic script disguised as a love letter. Windows often hid known extensions, making the file appear textual. Once run, the script overwrote files, copied itself and mailed the victim’s Outlook contacts.

Global spread came from combined conditions: curiosity, trust in a known sender, a misleading interface, easy script execution and automated address-book access. The modern pattern is clear: social engineering activates excessive privilege.

SQL Slammer: propagation limited by bandwidth

SQL Slammer exploited a buffer overflow in the SQL Server Resolution Service over UDP. It fit in one packet, did not persist to disk and generated random targets. With no connection setup, it spread extraordinarily quickly and congested networks.

A patch already existed. The failure was inventory and deployment: organisations did not know where vulnerable components ran or lacked an update process. The same visibility problem returned with Log4j, containers and edge appliances.

Conficker: resilient distribution

Conficker used a Windows service vulnerability, weak network-share passwords and removable media. It evolved communication mechanisms and generated domains to resist command-and-control takedown. An international working group brought together vendors, researchers and domain registries because no endpoint product could dismantle the global system alone.

Stuxnet and process-aware malware

Stuxnet went beyond Windows infection. It searched for a specific industrial environment, modified PLC logic and hid changes from operators. The cybersecurity history demonstrates why malware built with physical-process knowledge changed the field.

In OT, “isolate and reinstall” can stop production or create safety risk. Defence needs asset inventory, controlled maintenance windows, segmentation and cooperation between process engineers and security teams.

Mirai: default passwords at Internet scale

Mirai in 2016 scanned for IoT devices exposed through Telnet and tried a short list of default credentials. Compromised cameras and recorders became a botnet capable of large DDoS attacks. The root problem was not a sophisticated exploit but products shipped with predictable credentials and weak update lifecycles.

Publishing Mirai’s code produced many variants. The malware timeline shows the economics: one weak device has little value, but hundreds of thousands become an attack service.

Ransomware becomes a service economy

Modern ransomware monetisation uses digital payments, anonymous services and specialist roles. Ransomware-as-a-service separates developers, access brokers, operators and negotiators. Double extortion combines encryption and theft, so backups do not remove all risk.

WannaCry propagated automatically through SMB. NotPetya combined multiple lateral-movement techniques with destructive intent. The ransomware defence guide shows that major operational impact can also begin with compromised identity rather than a worm.

Defences that endure

1. Inventory and patching remove known entry paths.
2. Phishing-resistant MFA limits stolen passwords.
3. Allowlisting and least privilege reduce execution and persistence.
4. Segmentation and egress control constrain spread and C2.
5. EDR and central telemetry detect behaviour rather than only samples.
6. Offline backups with tested recovery protect availability, while response plans address theft.
7. Rehearsed incident response reduces time from signal to isolation.

Our ransomware defence guide connects these controls into a programme.

The modern chain: loader, infostealer and access broker

Current campaigns rarely stop at one executable. A malicious attachment, advertisement or fake update starts a loader. It profiles the environment, retrieves modules and establishes persistence. An infostealer collects browser passwords, session cookies, wallets and tokens. The resulting data can be sold to an initial-access broker, after which another operator performs discovery, privilege escalation, exfiltration and ransomware deployment.

Specialisation complicates attribution and explains why deleting a detected file does not end the incident. Responders must assume identity material may be stolen, revoke sessions, rotate secrets and review cloud control-plane logs. Our infostealer guide explains the identity response, while the incident-response tabletop guide shows how to rehearse decisions before a live compromise.

This chain also changes prevention. Blocking one hash is temporary. Browser credential protection, application allowlisting, restricted scripting, phishing-resistant authentication and outbound visibility target different stages. If several independent controls must fail before an attacker reaches domain administration or backups, the campaign becomes slower and more observable.

Frequently asked questions

What is the difference between a virus and a worm?

A virus infects another object and normally needs that carrier to execute. A worm discovers targets and copies itself automatically. One malware family can combine both behaviours.

Must a trojan replicate?

No. Its defining property is deception: it presents itself as a desired file or function. It may then download additional components.

Is antivirus enough?

No. Modern attacks use scripts, legitimate tools, stolen accounts and fileless techniques. Identity controls, hardening, segmentation, telemetry and response are also necessary.

Sources

• Fred Cohen, “Computer Viruses — Theory and Experiments”
• Cohen’s November 1983 experiments
• RFC 1135 analysis of the Morris worm
• SEI: formation of CERT/CC

To learn whether malware can move from an initial workstation to critical systems, book an internal network penetration test.