39.2 How Malware Spreads
Malware gharat yesayche common raste (Maharashtra SMB pan same pattern):
- Phishing email / WhatsApp link – fake invoice, "Courier delivery", "IT password reset"
- Drive-by – compromised / shady website silently drops payload (often via browser/plugin bugs)
- USB / removable media – autorun or user double-clicks
salary_sheet.exedisguised as folder - Supply chain – trusted update / vendor software already poisoned (rare but high impact)
- Cracked / pirated software – keygens and "full version" zip = trojan cafe
- Office macros –
.docm/.xlsm"Enable Content" → script downloads payload
Lab awareness: tumhi phishing template awareness class madhe dakhavu shakta – pan real malware link click nako, real payload host var save nako.
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Sends invoice-themed phishing with macro or link | Email filtering, attachment sandbox, disable macros by default, user reporting button |
| Leaves infected USB in parking (classic bait) | Disable autorun; USB allowlisting / control; endpoint alerts on new removable media executables |
| Trojans cracked software on file-share sites | Block unknown publishers; company software portal only; hash allowlists |
Ravindra Bagale's Tip
Students say "I'm careful" and then install a cracked plugin on their personal Chrome. One weak home PC + a reused password = a risk to the office. Company rule: software only from the IT portal. Don't worry – changing a habit is protection.
Ravindra Bagale's Tip – मराठी
Students "मी careful आहे" म्हणतात आणि personal Chrome वर cracked plugin लावतात. एक weak home PC + reused password = office ला risk. Company rule: software फक्त IT portal वरून. घाबरू नका – सवय बदलली = बचाव.
Ravindra Bagale's Tip – हिंदी
Students कहते हैं "मैं careful हूँ" और personal Chrome पर cracked plugin लगा लेते हैं. एक weak home PC + reused password = office के लिए risk. Company rule: software सिर्फ़ IT portal से. घबराओ मत – आदत बदली = बचाव.
Practice task
Raja-Rani Traders (Nashik) sathi 8-line user awareness notice Marathi+English mix: macros, USB, cracked apps, phishing. Mag Red vs Blue table madhun 3 spread methods pick karun "control + how we verify" column bhara.
Real incident: Emotet campaigns (public reporting)
Emotet was widely reported as a malware distribution botnet that often arrived via malicious Office documents and links, then dropped further payloads (including ransomware affiliates in later waves – per public vendor/CERT reporting). Weakness theme: macros + user click + weak email controls. Defence: block macros from internet, advanced email filtering, EDR, rapid isolation. Source: CERT-In / CISA / major vendor Emotet advisories (verify).