Malware Taxonomy and Capabilities — A Chaotic but Helpful Field Guide

"If you know the enemy and know yourself, you need not fear the sandbox." — Probably Sun Tzu, if he did incident response

You already know how attackers poke at web apps, enumerate APIs, and exploit sloppy OAuth flows because we just finished digging into automated crawling, endpoint discovery, and devs forgetting secure SDLC is a thing. Now we zoom out: what kinds of malware are attackers dropping after they get a foothold, what can those samples actually do, and how that matters when you're trying to detect or analyze them — or build a sandbox that doesn't get bamboozled.

Why this matters (without the boring slog)

Web app flaws give attackers entry. Malware is the toolkit they bring to exploit that entry for long-term gain.
APIs and tokens you skimp on become relay points for command-and-control, data exfiltration, and persistence.
Understanding malware taxonomy helps you prioritize defenses: some threats are noisy and obvious, others are stealthy ninjas.

Ask yourself: "If someone used my API to plant a backdoor, what kind of malware would they use, and what would it want to do next?" — That question links our last module to this one.

The Taxonomy: Types, not excuses

Here’s a compact table to stop calling everything a 'virus' like it’s 1998.

Type	Propagation	Typical Payloads/Capabilities	Stealth & Persistence	Why you care (example)
Virus	Requires user action (infects files)	Modify files, load malicious code	Can be persistent if modifying executables	Less likely in modern AP-led attacks but still shows attacker craft
Worm	Self-replicates across networks	Network spread, botnet recruitment	Often noisy but fast-moving	Can saturate services or spread from a compromised app server to internal systems
Trojan	Disguised as legitimate software	Backdoors, credential harvesters	Persistence via installers, scheduled tasks	Attackers lure admins into installing a 'tool' that carries a backdoor
Backdoor / Remote Access Trojan (RAT)	Delivered by other malware	Full remote control, C2 channels	Deep persistence, stealth C2	Used to maintain access after initial API/token misuse
Ransomware	Delivered by phishing, exploit chains	File encryption, extortion	Attempts to delete backups, escalate privileges	The endpoint impact we dread; often follows web app compromise to reach backups
Botnet Agent	Enlists host in distributed networks	DDoS, crypto-mining, spam	Periodic check-ins with C2	Compromised cloud instances abused for scale
Rootkit / Bootkit	Low-level kernel or boot-time code	Hide processes/files, escalated control	Very persistent, hard to detect	If attackers can modify boot or kernel, they own the host invisibly
Spyware / Keylogger	User-focused infection	Keystroke capture, screenshots, data exfil	Stealthy, may hide in userland	Good for stealing API keys, session tokens, or OAuth refresh tokens
Fileless malware	Lives in memory or uses OS tooling	Living-off-the-land use, script-based payloads	Minimal artifacts on disk	Evades simplistic file-based detection; commonly used after web compromises
Dropper / Downloader	Installer for other malware	Pulls additional stages from internet	Often short-lived on disk	First-stage from a web exploit or malicious dependency
Logic Bomb	Triggered by condition	Destructive action at a set time or trigger	Dormant until triggered	Dangerous in supply-chain or insider contexts

Capabilities — What malware actually does (and why defenders lose sleep)

Most modern malware is modular. Think of it as a Swiss Army knife where the attacker picks the blades they need:

Reconnaissance — Enumerates environment, processes, network topology, cloud metadata.
Credential Harvesting — Scrapes browsers, keychains, config files, environment variables (hello API keys).
Privilege Escalation — Exploits local flaws to get SYSTEM/root.
Persistence — Scheduled tasks, services, cron, registry run-keys, systemd units, bootkits.
Lateral Movement — SMB, WMI, RDP, stolen keys, misconfigured APIs used as pivot points.
Command-and-Control (C2) — HTTPS, DNS, social media, or legitimate cloud services abused as covert channels.
Data Exfiltration — Compression, encryption, chunking, hiding data in innocuous API traffic.
Destruction/Manipulation — Encryption (ransom), deletion, or tampering with logs/backups.
Anti-analysis & Evasion — Sandbox checks, obfuscation, polymorphism, living-off-the-land techniques.

Ask: "Which of the above would an attacker need to turn a compromised API key into a sustained breach?" — credential harvest, persistence, C2, and exfiltration are the usual suspects.

Real-world mini-cases (because theory is boring without drama)

A stolen service account key from a CI system lets a Trojan deploy a server-side downloader that becomes a backdoor. Stages: exploit -> dropper -> downloader -> RAT -> data theft.
A misconfigured OAuth flow grants refresh tokens to a malicious app. Spyware on a developer machine grabs tokens and a botnet agent abuses them to spin up crypto-miners in the cloud.
A fileless PowerShell script runs via a web-exposed task scheduler, living only in memory and using legitimate cloud APIs as its C2 channel.

These show the chain: web app flaw -> initial execution -> modular malware stages -> long-term objectives.

Contrasting perspectives: noisier attacks vs stealth ops

Noisy attacks (worms, many ransomware campaigns): Loud, fast, easier to detect, often opportunistic.
Stealth attacks (APT-like RATs, fileless espionage): Slow, tailored, focused on persistence and data theft. Harder to detect and common in targeted compromises where initial access came from compromised dev tools or API tokens.

Both matter. Your defenses must detect the quick and the quiet.

Quick primer: malware behavior pseudocode (so it feels tangible)

while (alive) {
  if (!has_privilege) escalate_privilege();
  enumerate_environment();
  harvest_credentials();
  if (need_more_stages) download_next_stage();
  if (persistence_not_installed) install_persistence();
  check_C2_and_execute_commands();
  exfiltrate_if_needed();
  sleep(randomized_interval());
}

This loop shows why timing checks and memory-only behavior are so effective at evading naive sandboxes.

Closing: Key takeaways and the path forward

Classification is not just academic: knowing what type of malware you face shapes your detection and response.
Focus on capabilities: Recon, persistence, credential theft, C2, and exfiltration are the pillars of malicious action.
Link it back to APIs and web flaws: compromised apps and tokens are common entry points; attackers pivot from there to deploy modular malware.
Expect evasive behavior: fileless techniques, living-off-the-land, and sandbox checks are common. Your analysis strategy must include behavioral detection and telemetry, not just signatures.

Final thought: Fortifying web apps and hardening CI/CD, tokens, and endpoints doesn’t just stop immediate exploitation — it denies attackers the staging ground for modular malware. Make that your north star.

Want next? We move from taxonomy to tactics: how malware detects sandboxes and how to build sandboxes that don’t get played for fools. Let’s make analysis less dance-and-pray and more science.

Malware Threats and Sandbox Evasion

Content