Malware Families Encyclopedia

Also: WanaCrypt0r, WCry, WanaCry

WannaCry was a ransomware worm that spread across the world in May 2017 by exploiting a Windows SMBv1 vulnerability that Microsoft had patched two months earlier (MS17-010).

Ryuk was a human-operated ransomware family used in targeted, high-ransom attacks on large organisations, including hospitals.

Also: LockBit 2.0, LockBit 3.0, LockBit Black, ABCD

LockBit was a ransomware-as-a-service operation that, according to the 2023 joint advisory by CISA and partner agencies, was the most deployed ransomware variant worldwide in 2022.

Conti was a ransomware-as-a-service family that CISA, the FBI and the NSA warned about in a September 2021 joint advisory, which reported more than 400 attacks on US and international organisations at that time.

Also: Sodinokibi, Sodin

REvil, also called Sodinokibi, was a ransomware-as-a-service operation behind several of the most disruptive attacks of 2021, including the July 2021 attack that pushed ransomware through Kaseya's VSA remote-management software to managed service providers and their customers.

Also: ALPHV, Noberus

BlackCat, also known as ALPHV, was a ransomware-as-a-service family written in Rust that could encrypt Windows, Linux and VMware ESXi systems.

Also: Clop

Cl0p is a ransomware family whose operators became known for mass data-theft campaigns against managed file transfer products.

Also: Akira_v2

Akira is a ransomware family first seen in 2023 that targets Windows systems and, through a separate variant, Linux and VMware ESXi hosts.

Black Basta is a ransomware-as-a-service variant first identified in April 2022.

Also: ExPetr, Petrwrap, Nyetya, Diskcoder.C

NotPetya struck in June 2017.

Also: Disttrack

Shamoon, also called Disttrack, is destructive malware first reported in 2012 attacks on energy-sector organisations in the Middle East.

Also: DriveSlayer, Trojan.Killdisk

HermeticWiper is destructive malware found on systems in Ukraine on 23 February 2022, the eve of Russia's full-scale invasion.

Also: Geodo

Emotet began as a banking trojan and grew into one of the most widespread malware delivery services, renting access to infected computers to other criminals who installed loaders and ransomware.

Also: Totbrick, TSPY_TRICKLOAD

TrickBot started as a banking trojan and became a modular platform for credential theft, network reconnaissance and delivering ransomware such as Ryuk and Conti.

Also: Qbot, Pinkslipbot, QuackBot

QakBot began as a banking trojan in the late 2000s and became a major malware delivery botnet used by ransomware affiliates.

Also: BokBot

IcedID began as a banking trojan and was increasingly used as a loader that gave ransomware operators their first foothold.

Mirai is malware that turns internet-connected devices such as cameras and routers into a botnet used for distributed denial of service (DDoS) attacks.

Also: Bugat v5

Dridex is a banking trojan, spread mainly through spam with malicious Office documents, that stole online banking credentials to make fraudulent transfers.

Agent Tesla is a .NET remote access trojan and information stealer sold to criminals as a service.

Also: RedLine

RedLine Stealer is an information stealer sold as malware-as-a-service.

Also: LummaC2, LummaStealer

Lumma Stealer, also called LummaC2, is an information stealer sold as malware-as-a-service that grew into one of the most used stealers.

Also: Bladabindi, Njw0rm, LV

njRAT is a remote access trojan written in .NET that has circulated freely for over a decade, so it is used by everyone from low-skill criminals to state-linked groups.

Also: Remcos RAT

Remcos is sold as legitimate remote control and surveillance software but is widely abused as a remote access trojan, delivered through phishing.

Cobalt Strike is a commercial tool built for red teams to emulate real attackers.

Also: W32.Stuxnet

Stuxnet, discovered in 2010, was the first widely known malware built to cause physical damage through industrial control systems.

Also: CrashOverride, Industroyer2

Industroyer, also called CrashOverride, was used in the December 2016 attack that cut power in part of Kyiv.

Also: TRISIS, HatMan

Triton is malware built to tamper with safety instrumented systems, the independent controllers that shut an industrial process down safely when something goes wrong.

Also: Black Energy

BlackEnergy started around 2007 as a criminal toolkit for DDoS attacks and evolved into a modular espionage platform.

Also: Solorigate

SUNBURST was a backdoor hidden inside legitimate, digitally signed updates of SolarWinds Orion network-management software in 2020.

Also: Pegasus for iOS, Pegasus for Android, Chrysaor

Pegasus is commercial spyware that, according to public reporting by Citizen Lab and others, has been used to monitor journalists, activists and politicians.