What is a malicious payload?
In the context of a cyber-attack, a payload is the component of the attack which causes harm to the victim. Much like the Greek soldiers hiding inside the wooden horse in the tale of the Trojan Horse, a malicious payload can sit harmlessly for some time until triggered.
Attack vectors such as viruses, wurms, and malware can all contain one or more malicious payloads. Malicious payloads can also be found in email attachments, in fact Symantec has reported that one in every 359 emails in existence contains a malicious payload, and this ratio is trending upward.
How do malicious payloads harm their victims?
Some typical examples of the way malicious payloads cause damage:
- Data theft: Particularly common is the theft of sensitive information such as login credentials or financial information through various forms of data breaches.
- Activity monitoring: An executed malicious payload may serve to monitor user activity on a computer, this can be done for the purposes of spying, blackmail, or to aggregate consumer behavior which can be sold to advertisers.
- Displaying advertisements: Some malicious payloads work to display persistent, unwanted ads such as pop-ups and pop-unders to the victim.
- Deleting or modifying files: This is one of the most serious consequences to arise from a malicious payload. Files can be deleted or modified to either affect the behavior of a computer, or even disable the operating system and/or startup processes. For example some malicious payloads are designed to ‘brick’ smartphones, meaning they can no longer be turned on or used in any way.
- Downloading new files: Some malicious payloads come in very lightweight files that are easy to distribute, but once executed they will trigger the download of a much larger piece of malicious software.
- Running background processes: A malicious payload can also be triggered to quietly run processes in the background, such as cryptocurrency mining or data storage.
How are malicious payloads executed?
Attackers must first find a method to deliver the malicious payload onto the victim’s computer. Social engineering attacks and DNS hijacking are two common examples of payload delivery techniques.
Once a payload is in place, it will usually sit dormant until being executed. An attacker can select from many different ways to execute a malicious payload. Some common ways to execute a malicious payload:
- Opening an executable file: For example a victim downloads an email attachment that they believe to be a piece of pirated software and they double-click on the installation file which executes the payload.
- Setting off a specific set of behavioral conditions: This is known as a logic bomb. For example, an unscrupulous employee might integrate a logic bomb into his company’s network that continually checks to see if that employee is still on the payroll. When he is no longer on the payroll, the logic bomb will meet its condition and the malicious payload will be executed.
- Opening certain non-executable files: Even some non-executable files can contain malicious payloads. For example there are attacks where malicious payloads are hidden in .PNG image files. When a victim opens these image files, the payload is executed.
How to stop malicious payloads
As there are so many different methods for the distribution and execution of malicious payloads, there’s no simple panacea to mitigate them. In addition to being wary of phishing scams and other social engineering attacks, security measures should be taken whenever downloading files or receiving any kind of data from the Internet. A good general rule is to always run a virus scan on downloaded files, even if they appear to be from a trusted source.