Worm
noun · NIST CSRC Glossary
Malware that copies itself from system to system on its own, usually by exploiting a vulnerability, without any user action.
A worm is self-propagating. Where a virus needs an infected file to be run and a trojan needs a victim to install it, a worm finds its next target by itself: it scans the network for vulnerable machines, exploits them, and starts scanning again from each new host. That is why worms can spread across an organization, or across the internet, in hours.
Worms usually rely on a vulnerability in a network service, weak or default passwords, or shared folders and removable drives. The damage depends on what they carry: some only spread, others drop ransomware, wipers or backdoors on every machine they reach.
Example
In May 2017, WannaCry spread worldwide in a matter of days by exploiting a vulnerability in Windows SMBv1 (patched by Microsoft in bulletin MS17-010 two months earlier). Every machine it infected encrypted its files and immediately began scanning for other unpatched systems, both inside the network and on the internet.
Why it matters for a SOC analyst
Worm outbreaks are among the few incidents where minutes matter: containment means isolating segments and blocking the propagation path, such as the vulnerable port, before investigating each host. Afterwards, the root cause is almost always the same: an exposed or unpatched service, often on systems nobody remembered were still running.
Related terms
- Malware
Any software designed to harm a system or its users, such as viruses, worms, trojans, ransomware, spyware and infostealers.
- Ransomware
Malware that encrypts an organization's data and demands payment for the key, often after stealing the data to threaten its release.
- Zero-day
A vulnerability that attackers exploit before the vendor has released a fix, so defenders have had zero days to patch it.
- Lateral movement
The techniques attackers use to move from the first compromised system to other systems and accounts inside a network.