Which Of The Following Characteristics Describe A Worm

You've seen the alerts. And somewhere in the back of your mind, you've wondered: what actually makes a worm a worm? Maybe your antivirus popped up a warning. Because of that, not a trojan. Not a virus. Maybe your IT team sent one of those "don't click this link" emails for the third time this month. A worm.

The distinction matters more than most people realize. On the flip side, because the way a worm spreads — and the damage it does once it's inside — follows a logic all its own. If you understand that logic, you stop reacting and start preventing.

What Is a Computer Worm

A worm is a type of malicious software designed to replicate itself and spread across networks without human interaction. They're self-contained. That's why they don't attach themselves to other files. That last part is the key. Worms don't. Viruses need a host file and usually need you to run something — open an infected document, launch a compromised program. They don't need you to double-click anything.

They just... go.

Here's the thing about the Morris Worm in 1988 was the first big wake-up call. Written by a graduate student who claimed he just wanted to measure the size of the internet, it ended up crashing roughly 10% of all connected machines at the time. Not because it was destructive by design — but because its replication logic had a flaw that caused it to reinfect machines over and over until they froze.

You might be surprised how often this gets overlooked.

That's the thing about worms. Even the "harmless" ones rarely stay harmless.

How Worms Differ From Viruses and Trojans

People use "virus" as a catch-all term. It's not accurate.

A virus modifies legitimate files. On the flip side, it injects its code into executables or documents, and it spreads when those files are shared or executed. A trojan disguises itself as something useful — a game, a utility, a software update — and relies on social engineering to trick you into running it.

A worm? A worm is a standalone program. It lives in memory. So it scans for vulnerable systems. It copies itself over the network. And it does all of this autonomously.

Some malware blends categories. Consider this: stuxnet, for instance, used worm-like propagation but also had virus-like components and trojan-like deception. But the core propagation mechanism — that self-driven, network-aware spreading — is what makes it a worm at heart.

Why Worms Matter More Than You Think

Most malware wants something from you. Also, ransomware wants payment. Which means spyware wants data. Banking trojans want credentials. Also, worms? Worms often just want to spread.

But that doesn't make them less dangerous.

A worm that "only" replicates can still bring networks to a standstill. The bandwidth consumption alone — millions of infected machines scanning, connecting, transferring copies of themselves — can saturate links and crash routers. We saw this with Code Red in 2001. We saw it again with SQL Slammer in 2003, which infected 75,000 servers in ten minutes and took down ATM networks, 911 systems, and airline booking platforms.

And modern worms rarely stop at replication. On top of that, they carry payloads. They open backdoors. They install cryptominers. They drop ransomware. On the flip side, they recruit machines into botnets for DDoS attacks. The worm is just the delivery truck. What's in the back matters.

The Network Effect

Here's what makes worms uniquely terrifying: their growth is exponential, not linear.

One infected machine scans and finds ten vulnerable neighbors. Those ten each find ten more. Within hours, you're looking at millions of compromised systems. Traditional perimeter defenses — firewalls, gateways — struggle because the attack originates from inside* the network once the first machine falls. Lateral movement happens fast. By the time alerts trigger, the worm has often already touched hundreds of endpoints.

Segmentation is worth taking seriously — and now you know why. This is why zero-trust architectures matter. This is why "we have a firewall" has never been a sufficient answer.

How Worms Work: The Technical Mechanics

Let's break down what actually happens under the hood. Not in abstract terms — in the specific steps a worm takes from initial foothold to widespread propagation.

1. Initial Infection Vector

Every worm needs a way in. The most common vectors:

Network service vulnerabilities — This is the classic worm path. An exposed service (SMB, RDP, SSH, a web server, a database listener) has an unpatched flaw. The worm sends a crafted packet, exploits the vulnerability, and executes code on the target. No user involved. WannaCry used EternalBlue, an SMBv1 vulnerability. Conficker used a Windows RPC flaw. The pattern repeats.

Weak or default credentials — Some worms don't bother with exploits. They just try passwords. Mirai and its variants scanned for IoT devices — cameras, routers, DVRs — and tried factory default credentials. Worked alarmingly often.

Phishing with automated follow-through — This blurs the line. A user clicks a malicious link or opens a document. But instead of just infecting that machine, the payload immediately begins scanning the local network for other vulnerable systems. Emotet evolved this way — starting as a banking trojan, adding worm-like propagation modules.

Supply chain compromise — Less common for pure worms, but devastating when it happens. If a trusted software update mechanism is compromised, the "worm" component can ride the legitimate distribution channel. NotPetya used a compromised Ukrainian accounting software update as its initial vector, then spread via EternalBlue and credential theft.

2. Reconnaissance and Scanning

Once executing on a host, the worm needs to find new targets. This phase varies:

Random scanning — The worm generates random IP addresses and probes them. Simple, noisy, eventually effective. SQL Slammer did this.

Local subnet scanning — Smarter worms prioritize the local network first. They know internal addresses are more likely to share vulnerabilities and trust relationships. WannaCry scanned both local subnets and random internet IPs.

Hit-list scanning — The worm carries a pre-compiled list of potentially vulnerable targets. Faster initial spread, but requires prior intelligence gathering.

Topological scanning — The worm uses information from the infected host — ARP tables, routing tables, DNS caches, SSH known_hosts files — to discover new targets. This is how worms jump network segments efficiently.

Permutation scanning — A coordinated approach where each infected machine scans a different portion of the address space, avoiding duplication. Theoretical but demonstrated in research.

3. Exploitation and Transfer

Found a target? Now the worm needs to copy itself over and execute.

Remote code execution — The exploit itself deposits and runs the worm binary. Clean, fast, no authentication needed.

Credential-based lateral movement — The worm uses stolen or guessed credentials to authenticate via SMB, WMI, PsExec, SSH, RDP, or WinRM. Then it copies itself (often to ADMIN$ or C$) and executes remotely. This is how worms spread in patched environments — they don't need a vuln if they have valid creds.

Self-contained transfer — Some worms carry their own transfer mechanism: a tiny HTTP server, a TFTP client, a custom protocol. The target connects back, downloads the worm, runs it.

If you found this helpful, you might also enjoy what is the remainder for the synthetic division problem below or which is greater 1.09 or 1.093.

4. Persistence and Evasion

A worm that gets wiped on reboot fails. So they establish persistence:

• Registry Run keys
• Scheduled tasks
• Service installation
• Startup folder placement
• WMI event subscriptions
• Bootkit / rootkit components (rarer, more complex)

Evasion techniques include:

• Process injection (hollowing, doppelgänging)
• Living-off-the-land binaries (LOLBins) — using certutil, bitsadmin, powershell, wmic for transfer/execution

mshta, rundll32, etc.

• Anti-VM / anti-sandbox checks (delaying execution, checking for human input)
• Timestomping, log clearing, clearing the SRUM database
• Disabling security tools, adding firewall exclusions

5. Payloads and Objectives

The worm's reason for existing:

Damage — Wiper payloads (NotPetya, Shamoon). Not ransomware, despite appearances — the goal is destruction. Encryption keys are random, unrecoverable. The damage is the point.

Ransomware — WannaCry, Conti, Ryuk variants that self-propagate. Combine worm efficiency with extortion monetization.

Cryptojacking — The worm spreads to mine cryptocurrency on every machine it can. Lower profile, quieter, longer ROI.

DDoS botnet — Mirai's descendants recruit IoT devices for massive DDoS.

Espionage — Steal data while spreading, exfiltrate quietly.

Multi-stage — Modern worms often drop a loader that pulls down whatever secondary payload the operator wants. The worm is the delivery mechanism; the payload is modular.

The Economics of Worms

Why do worms exist when targeted attacks are more efficient? Because scale creates value:

• Ransomware operators want maximum infection footprint before defenders react. A worm encrypts 300,000 machines before you finish reading this sentence.
• Nation-state actors want deniability and chaos. A worm spreading globally isn't attributable to one operation.
• Cryptojackers want CPU cycles. Hundreds of thousands of infected machines generate real money.
• Botnet operators want scale. DDoS for hire requires millions of nodes.

The economics improve with automation. Human-operated attacks are expensive and slow. Worms are fire-and-forget.

The Defender's Dilemma

Defending against worms requires defending against everything, all the time. A single unpatched host, one weak password, one misconfigured firewall rule — and the worm walks in.

Patching is the obvious answer but patching is hard. Legacy systems, business-critical applications, change windows, compatibility testing. There's always a machine that didn't get updated.

Network segmentation limits blast radius. Flat networks are worm paradises. VLANs, ACLs, microsegmentation — they make topological scanning harder.

Credential hygiene defeats credential-based lateral movement. Unique passwords, MFA, tiered admin models, no shared service accounts. LAPS for local admin passwords. Tier-0 asset isolation.

EDR/XDR catches behavior that signatures miss. Even if the exploit is novel, the post-exploitation behavior — process injection, persistence mechanisms, lateral movement — looks the same.

Application whitelisting and attack surface reduction rules (ASR) block the LOLBins worms abuse. No PowerShell? No rundll32? The worm's toolbelt shrinks.

Zero Trust architecture assumes breach. No implicit trust between hosts. Every connection authenticated, every lateral move verified. The worm can't ride trust because there is no trust to ride.

Outbound traffic filtering stops self-propagation. If infected hosts can't reach the internet or other subnets, the worm starves.

Backups aren't a defense against infection but they're the recovery mechanism. Air-gapped, immutable, tested backups. Worms like NotPetya specifically target backups — you need offline copies.

The Future of Worms

Worms haven't disappeared. They've evolved:

Cloud-native worms — Spreading through misconfigured Kubernetes clusters, exposed Docker APIs, stolen cloud keys. CodeRed moved from mainframes to servers; today's worms move from servers to cloud workloads.

Supply chain worms — SolarWinds, 3CX, MOVEit. Compromise the vendor, ride the update to every customer. Fewer exploits needed; trust does the work.

Living-off-the-cloud worms — Abusing legitimate cloud services (OneDrive, Dropbox, AWS S3) for command-and-control. Defenders can't block the cloud provider.

AI-assisted worms — Adaptive target selection, dynamic payload generation, evasion tuned in real time based on what the victim environment looks like.

Ransomware-worm hybrids — The dominant model. Human operators handle initial access, worms handle propagation. Initial access broker → worm loader → ransomware payload → extortion.

The future worm is less about exploiting vulnerabilities and more about exploiting trust — trust in software updates, in cloud configurations, in credentials, in services. The technical bar is lower; the human and organizational surface is larger.

Conclusion

Worms are the most visceral demonstration of why security is systemic. A single compromise becomes thousands, then millions, in hours. The defenses aren't exotic: patch systematically, segment networks, manage credentials ruthlessly, monitor behavior, assume compromise, prepare to recover. The challenge isn't knowing what to do — it's doing it consistently across thousands of endpoints, dozens of teams, and years of accumulated technical debt.

The worms keep getting smarter. The defenders need to get more consistent. The gap between the two is where incidents live.