UPI Study › Courses › Ethics in Technology › Free lessons › Lesson 9.10 Free with a free account
Malware Functions: Spyware, Ransomware, Adware, and Beyond
Ethics in Technology · Chapter 9: Data Breaches, Digital Infections, and the Malware EcosystemSection 9.10 · lesson 51 of 11614 min · free with a free account
Free preview
Create a free account to keep watching
It takes a minute and costs nothing. Your free account unlocks all of Chapter 1 and 3 more lessons of Ethics in Technology.
Lesson complete
Earn the 3 college credits for Ethics in Technology
Enrolling adds a quiz after each lesson, the graded work and the official transcript. Recommended for credit by NCCRS.
Next lesson: Fundamental Concepts of Network Protection →← Malware Detection Methods and ToolsNext lesson: Fundamental Concepts of Network Protection →
In this lesson
Information theft, extortion, resource abuse, and concealment.
- Group eight overlapping malware categories by function.
- Explain spyware, keyloggers, ransomware, and resource abuse.
- Recognize rootkit and fileless visibility limits.
- Assess symptoms, recovery, and payment tradeoffs.
Free study notes
Get this lesson's notes by email
The key points and 4 practice questions with answers, in your inbox. One email, free.
One email. Unsubscribe in one click.
Transcript
Everything said in the video, section by section (1,669 words). Read along, or search it.
Chapter 9
Malware Functions
Malware categories describe functions that often overlap within a single incident. We group eight examples by information theft, payment pressure, resource use, and concealment. Spyware collects sensitive activity, while keyloggers focus on supported typed input. Ransomware disrupts access and demands payment, sometimes adding threats about stolen information. Bots coordinate controlled devices, cryptojacking abuses computing resources, and adware monetizes unwanted advertising. Rootkits can interfere with reporting, making ordinary system views less trustworthy. Fileless techniques reduce reliance on ordinary malware files, rather than eliminating every possible artifact. We examine warning signs without treating silence as safety or visibility as harmlessness. Backups help recovery, but do not undo information already copied away. Payment decisions involve human harm, uncertain promises, incentives, authority, and applicable law. Throughout, technical findings need context and ethical judgment about affected people.
Overlapping Categories
Ask What the Operator Obtains, Rather Than Choosing One Exclusive Label
Ask what an operator obtains from the device before assigning a single exclusive label. Information theft includes spyware collection and keylogging. Payment pressure includes ransomware disruption, sometimes combined with threatened disclosure. Resource abuse can exploit computing power, network access, or the owner's attention. Concealment mechanisms can help other malicious functions remain less visible. A Trojan could introduce a rootkit, keylogger, or bot capability before later ransomware. That is a possible combination, rather than a required sequence in every incident. Fileless describes a technique that can support various malicious objectives. Likewise, a rootkit may support more than hiding alone. The objective explains necessary actions and possible evidence, but does not reveal the entire incident automatically. Several labels can apply together, and a visible symptom does not establish complete scope or severity.
Spyware and Consent
Collecting Personal Activity Creates Ethical Duties Beyond Technical Capability
Spyware collects and transmits information without meaningful consent. Possible targets include browsing, documents, messages, contacts, location, screenshots, and application activity. Monitoring software advertised for employers or parents can also enable covert partner surveillance. Technical collection capability alone does not establish legitimate authority. Ask who is monitored, who can refuse, and whether power differences undermine consent. The purpose must justify the scope of collection, rather than authorizing every intimate detail. Access, protection, and retention determine who can use sensitive records and for how long. Applicable legal requirements vary, alongside the ethical duties of consent and proportionality. Unexpected device changes warrant investigation, while not proving surveillance by themselves. Where partner abuse is suspected, use a safer device to seek trusted support and plan next steps. Removing suspected stalkerware may alert an abuser or increase danger, so personal safety guides the response.
Keyloggers
Typed Input Can Be Captured Before an Application Protects Its Transmission
A keylogger records supported typed input, often as part of a larger compromise. Software can capture keyboard input on the device before the application protects its transmission. Typed credentials, messages, or card information may then support later abuse. Encrypted transport can protect network data while malicious endpoint software captures input earlier. Coverage varies, so not every input method or authentication process is equally exposed. A hardware keylogger records input along a physical keyboard connection. It generally requires physical access and may escape ordinary file scanning. Physical inspection and approved equipment inventories therefore add useful evidence. An unfamiliar adapter is a clue to examine, rather than automatic proof of wrongdoing. Protect physical access, endpoint integrity, and account security together. A quiet device or clean file scan does not rule out every hardware or software collection mechanism.
Ransomware and Double Extortion
Preparation Can Narrow Recovery Options Before the Demand Appears
Ransomware can encrypt or otherwise lock needed data and demand payment for recovery. The visible demand may follow an intrusion that already narrowed the organization's options. Operators may expand account authority, reach other systems, interfere with recovery, and copy selected data. Some incidents develop over days or weeks, while others unfold much faster. Not every incident follows every step, destroys backups, or includes data theft. Double extortion adds threatened disclosure of stolen information to disruption. Protected backups can help restore availability, depending on their completeness, timing, and usable recovery resources. They do not undo a confidentiality breach when information has already been copied away. Data-theft extortion can also occur without ransomware encryption. The demand does not mean further action is pointless or every decision has already been settled. Safe containment, protection of unaffected systems, investigation, and clean recovery can still limit harm.
Payment Ethics
Weigh Immediate Human Harm, Uncertain Restoration, Future Incentives, and Law
Payment decisions require attention to immediate harm and the uncertainty of the attacker's promises. A hospital may face urgent care disruption, while councils and retailers also affect people's lives. Assess actual consequences and contingency options instead of deciding only from an organization label. Protected backups, clean rebuilding, safe workarounds, or trusted available decryptors may offer alternatives. Payment does not guarantee useful restoration or verifiable deletion of stolen information. It can fund operations and encourage further extortion. The FBI does not support paying a ransom. A September twenty twenty-one Treasury advisory warns that payments or facilitation can violate applicable United States sanctions. That does not mean every payment is universally illegal under every jurisdiction. Authorized decision makers need relevant incident and legal expertise, with documented reasons and responsibilities. Weigh safety, service harm, restoration limits, future incentives, and the confidentiality loss that payment cannot reliably undo.
Machine Resources and Attention
Bots, Cryptojacking, and Adware Monetize Different Parts of a Compromised Device
A malicious bot puts a device under external control as part of a coordinated resource. Network access and computing capacity can serve harmful traffic or other tasks. Some bots stay quiet, while others consume resources or disrupt service. Cryptojacking uses computing resources without authorization to generate cryptocurrency at the owner's expense. Costs can include electricity, performance, equipment strain, and cloud spending. Heat, fan noise, reduced battery life, or unexplained idle load can be clues. Resource use may be limited or concealed, and these signs are not proof by themselves. Adware generates value through unwanted advertising, clicks, redirects, or tracking. Its behavior can overlap with spyware, while legitimate advertising and automation are not automatically malware. Unexpected advertisements can arise from websites or extensions, so investigate provenance and permissions. None of these categories has a guaranteed low severity, and resource abuse can accompany information theft.
Rootkits
A Compromised System Can Misreport Its Own State
A rootkit can interfere with reporting to conceal relevant activity. Processes, files, or connections may be omitted or altered in ordinary system views. Application-level concealment can sometimes be exposed through appropriately independent lower-level inspection. A compromise in the operating-system core can undermine tools relying on that core. Firmware operates outside the installed operating system and creates different inspection and recovery challenges. Some firmware compromise can survive reinstalling the operating system or replacing its system drive. That is not a property of every rootkit. Trusted external media reduces reliance on a suspect operating system, but does not guarantee complete visibility. Specialists may need checks and recovery appropriate to the actual affected firmware. Maintain startup trust, compare independent evidence, and investigate meaningful discrepancies. A clean ordinary process list is limited evidence, rather than proof that every layer is clean.
Fileless Techniques
Reduced Reliance on Malware Files Changes Which Evidence Is Useful
Fileless techniques reduce reliance on a standalone malware file stored on disk. Activity can use memory, scripting environments, management tools, or other legitimate operating-system components. Some stages avoid a stored payload, while other stages still involve files. An unauthorized startup setting may restart activity after a reboot. Fileless therefore does not mean artifact-free, persistence-free, or undetectable. A file-only check may miss a memory payload, while other protection examines supported script content or behavior. Memory, configuration, process relationships, permissions, timing, and connections can add evidence. Legitimate tools can be restricted through appropriate roles and approved application policies. An office application launching an unusual scripting environment can be suspicious in context, rather than automatically guilty. Investigate unauthorized configuration, account compromise, and the entry cause. Restarting or deleting one file is not a universal remedy for the broader compromise.
Warning Signs
Clues Guide Investigation, While Silence and Visibility Do Not Rank Severity
Warning signs should guide investigation, rather than substitute for it. Spyware or keylogging may produce little noticeable change, while hardware inspection can reveal an unfamiliar adapter. Ransomware may first appear through unusual administration, recovery failures, locked data, or a demand. A rootkit can produce discrepancies between suspect-system reports and independently trusted checks. Bots may create unfamiliar connections, although operation can be quiet or disruptive. Fileless activity may leave unusual tool sequences, startup settings, memory evidence, or inspectable scripts. Cryptojacking can change load, heat, battery use, or cloud spending. Adware can produce unexpected advertisements, redirects, search changes, or unfamiliar extensions. Legitimate workloads and equipment changes can explain many of the same clues. Both quiet and visible incidents can cause severe harm, so symptoms do not establish a universal severity ranking. Use relevant endpoint, account, privilege, network, and recovery evidence without waiting for obvious discomfort.
Defense and Recovery
Protect People and Options Before, During, and After an Incident
Preparation protects people and preserves response options. Patch systems, limit authority, protect physical access, govern monitoring, and maintain useful detection. Use appropriately isolated or protected backups, and test completeness and restoration time. During an incident, investigate context, preserve needed evidence, and identify affected accounts and systems. Contain through authorized procedures, while considering essential service and personal-safety consequences. Use trusted rebuilding or targeted remediation appropriate to the compromised layers. Address the entry cause and verify restoration, instead of assuming a restarted device is clean. Backups, detection, and containment address different risks and complement each other. Confidentiality loss can require further assessment and appropriate notification even after service returns. Configuration and account compromise can remain relevant without an obvious malware file. Earlier controls matter, and later safe action can still protect unaffected resources and limit further harm.
Review
Explain Mechanisms, State the Limits, and Justify the Response
Reliable offline backups do not guarantee complete or rapid recovery, and cannot undo stolen information. The quiet intrusion phase matters because spread, account abuse, copying, or recovery interference can narrow options. Visible encryption still leaves useful containment, investigation, and recovery work. Fileless techniques require evidence beyond ordinary stored files, while scripts, settings, or other artifacts may remain. Rootkits make particular reports less trustworthy, so independently trusted checks add evidence with their own limits. Quiet operation is not reassurance, and conspicuous operation does not establish low severity. Ask whose information, resources, and attention are used, and whether authority and consent are meaningful. Assess how people are harmed and which response is justified. Payment buys an uncertain promise, while prevention and recovery also demand proportionality and accountability. These categories describe overlapping functions rather than exclusive species. Examine evidence, preserve uncertainty, and verify the response instead of treating one label or symptom as a complete explanation.
About Ethics in Technology at UPI Study
Ethics in Technology (Computer Science 195) is a self-paced online course of 116 video lessons in 15 chapters, from cybersecurity basics, privacy and surveillance to big data, hacking, malware, network defense, intellectual property, cybercrime, encryption, emerging technology and digital citizenship. It carries a NCCRS credit recommendation for 3 semester credits.
Every lesson transcript is free on pages like this one, and the videos are free with a free UPI Study account. Enrolling adds a practice quiz after each lesson, the graded work and final exam that earn the credit, lifetime access, and an official transcript on completion. UPI Study has helped over 130,000 students with college credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Enroll now → Course details Download the syllabus All Computer Science courses
Compare: Cybersecurity vs Ethics in Technology · Which ethics course?
Why take it here
Why students take Ethics in Technology with UPI Study
Where the credit goes
Universities that work with NCCRS
Ethics in Technology carries a NCCRS credit recommendation. These universities work with NCCRS; some are UPI Study's signed partners. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Thomas Edison State UniversitySigned partner
University of the PeopleSigned partner
Charter Oak State CollegeSigned partner
Strayer UniversitySigned partner
Columbia Southern UniversitySigned partner
Indiana TechSigned partner
Penn StateWorks with NCCRS
Southern New Hampshire UniversityWorks with NCCRS
SUNYWorks with NCCRS
+many more cooperating universitiesFind my college →Find my college → Not listed? Ask Athena in the corner of this page, or book a 15-minute call.
FAQ
Questions students ask us
About Malware Functions: Spyware, Ransomware, Adware, and Beyond
What is the difference between spyware and a keylogger?
What is double extortion ransomware?
Should an organization pay a ransomware demand?
What is a rootkit and why is it hard to detect?
About the Ethics in Technology course
How many college credits is Ethics in Technology?
How much does Ethics in Technology cost and what is included?
Which universities accept UPI Study credits?
How long does Ethics in Technology take?
How are the exams done?
How do my credits reach my college?
Ready for the full course? Earn 3 credits in Ethics in Technology.
116 video lessons, a quiz after each one, and the graded work that earns the credit. Recommended for credit by NCCRS.
3 credits · NCCRSEnroll →