Malware and ransomware.
Malware is just a program written to do something bad. Today you'll learn the main families, how they get in, how ransomware can shut down an entire hospital, and the one habit that defeats it.
Malware = malicious software
Remember Lesson 2: every program is a recipe. Malware is a recipe written to harm you. There are many families, each with its own "personality".
| Type | What it does | Simple picture |
|---|---|---|
| Virus | Attaches to files and spreads when they're shared | A cold that spreads by handshakes |
| Worm | Spreads by itself across a network, no clicking needed | A fire jumping from house to house |
| Trojan | Pretends to be a useful app but has a hidden purpose | The famous wooden horse with soldiers inside |
| Spyware | Secretly watches: messages, location, keystrokes | A hidden camera in your room |
| Keylogger | Records everything you type, including passwords | Someone reading over your shoulder |
| Ransomware | Locks your files and demands money | A kidnapper holding your files for ransom |
| Botnet malware | Turns your device into a "zombie" controlled remotely | Your phone secretly working for a gang |
A "free PUBG UC generator" app actually steals the Instagram login on your phone. What type of malware is this?
It pretends to be useful (free UC) but has a hidden harmful purpose. That's a Trojan, and also spyware because it steals data.
How malware gets in
- APK files shared on WhatsApp or Telegram: "Wedding invitation.apk", "PM Kisan update.apk". A wedding invite is never an app.
- Cracked software: free Photoshop, games, "activators". Very often bundled with malware.
- Email attachments: invoices, CVs, "salary slips" with macros.
- Fake updates: "Your Chrome is outdated, click to update" pop-ups on websites.
- USB drives found or shared.
- Unpatched software: some worms need no click at all.
The "wedding card APK" scam is very common in India: a message from a known or unknown number with an invitation file ending in .apk. Installing it gives attackers control of your SMS, so they can read your bank OTPs. Wedding cards are images or PDFs, never apps.
Ransomware: the most dangerous family
Ransomware encrypts (scrambles) your files with a key only the attacker has, then shows a note: "Pay in Bitcoin within 72 hours or lose everything." Modern gangs also steal the data first and threaten to publish it: "double extortion".
Ransomware has shut down hospitals, airports and government offices around the world, including in India. For a business, a ransomware attack can mean days or weeks with no computers at all.
Should victims pay?
Security agencies generally advise not to pay: there's no guarantee you'll get files back, and paying funds more crime. The real answer is to be prepared so you never have to choose.
The habit that beats ransomware: backups
If you have a clean, recent copy of your files somewhere the ransomware can't reach, the attack loses its power. Professionals follow the 3-2-1 rule:
- 3 copies of important data,
- on 2 different types of storage (for example laptop + external drive),
- with 1 copy offline or off-site (an external drive kept unplugged, or a cloud backup with version history).
A backup that's always plugged in can get encrypted too. The "1 offline copy" part is what saves you.
Defences in short
- Install apps only from the Play Store / App Store, and never install APKs from messages.
- Keep phone, Windows and apps updated (Lesson 2!).
- Use antivirus: Windows Defender (Microsoft Defender) built into Windows is genuinely good. Keep it on.
- Use a normal (non-admin) account for daily work.
- Back up with the 3-2-1 rule.
A small clinic in Mehdipatnam gets ransomware. Which preparation would help them MOST?
With tested offline backups, the clinic can wipe the infected computers and restore its data without paying. "Tested" matters: many people discover their backups don't work only when they need them.
Your task (15 min)
Set up your own backup. On your phone, turn on Google Photos backup (or iCloud) for your photos. For important college documents, keep a copy in Google Drive and on a pen drive that you keep unplugged. Then check your phone's Downloads folder and delete any .apk files you don't need.
Lesson 7 complete!
You know the main types of malware, how they spread, how ransomware works, and the 3-2-1 backup rule. Next: how passwords get cracked, plus the Module 2 test.
Next: Passwords and how they get cracked →