Trojan Horse Explained — Types, Delivery Vectors, and Defenses

News articles often use "virus", "malware", "Trojan", and "ransomware" interchangeably, but technically there is a clear distinction in function and behavior. It's also routine for a single piece of malware to belong to multiple categories at once (e.g. WannaCry = Worm + Ransomware).

Classification by spreading method #

Classification by purpose (what gets carried inside the Trojan) #

A finer breakdown of Trojan functionality lines up directly with the criminals' economic goals:

How a Trojan reaches a user's PC has changed dramatically over the past decade. With Office macros sealed by default (Microsoft 2022) and broader OS hardening, the old methods stopped working — and new delivery vectors have steadily emerged in their place.

• Phishing email attachments — still the overwhelming #1. .docm (macro-bearing Word) is in decline, replaced by .iso / .lnk / .one (OneNote) / .svg / HTML smuggling
• HTML smuggling — HTML inside the email assembles a zip via in-browser JS, so EDR can't catch it as a file attachment
• Malvertising — paid ads at the top of search results that impersonate "official software download" pages (PuTTY, Notion, OBS, VS Code all have many fake-ad cases). Google Ads has repeatedly failed to clean these up
• Pirated / cracked software — Adobe / Office / game cracks come with Trojans bundled in. "Free things you find" always carry risk
• Vishing (voice phishing) — "This is IT support, your PC has been compromised". Attackers operate legitimate remote-access tools like AnyDesk / TeamViewer
• USB drops — leaving a USB labeled "Payroll 2026" in a parking lot. The classic still works against enterprise targets
• Drive-by download — infected by visiting a page, via a browser vulnerability. Sandboxing made this hard but zero-days still get there
• Supply chain — poison a legitimate software's update mechanism to ship to every customer. SolarWinds Sunburst (2020) / 3CX (2023) / XZ utils backdoor (2024) are the representative cases
• Living off Trusted Sites — abusing GitHub / Discord / Telegram / Cloudflare R2 / AWS S3 as malware delivery and C2 channels

Walking a Trojan's behavior in MITRE ATT&CK Tactics order lays out the path from "the click" to "ransomware fires":

Where to stop it #

• Stages ①–② — email filtering / macro disablement / no pirated software / Application Allowlisting (most effective)
• Stages ③–⑤ — EDR behavioral detection / blocking C2 domains at the proxy (the modern battleground)
• Stages ⑥–⑨ — LSASS protection / network segmentation / Tier management / honey tokens
• Stage ⑩ — almost always too late. Restoring from backup is the last line of business continuity

The biggest challenge for malware is "surviving a reboot". The Windows persistence (Persistence) catalogue, shown with Registry examples:

Classic Defense Evasion #

• Packer / Crypter — UPX / Themida / commercial packers encrypt the code and unpack at runtime to evade AV signatures
• Polymorphic / Metamorphic — transform the code on every infection so signatures don't match
• Code-signing certificate abuse — sign with a stolen legitimate vendor cert (Stuxnet used Realtek / JMicron certs)
• Process injection / hollowing — inject the attacker's code into legitimate processes like explorer.exe and svchost.exe
• LOLBins (Living off the Land Binaries) — use legitimate system tools like powershell, mshta, certutil, regsvr32, rundll32, bitsadmin to do what malware would do (catalogued at LOLBAS Project)
• Sandbox detection — look at VM / sandbox tells (low RAM, accelerated sleep, specific drivers) and self-terminate
• Sleep / Stalling — wait hours or days before doing anything, defeating short-window sandbox analysis

The model has evolved from "a single hacker writes and distributes" into a commercial ecosystem with proper division of labor — structurally similar to the software industry itself.

• MaaS (Malware-as-a-Service) — the author rents malware out to other criminals for a monthly or per-use fee. RedLine Stealer is $200/month, LockBit takes 20% of the ransom for the author
• RaaS (Ransomware-as-a-Service) — the specialized form. "Affiliates" handle intrusion; encryption and negotiation are run by HQ
• IAB (Initial Access Brokers) — brokers who trade "a foothold into Company X's internal network (RDP/VPN credentials)" for $1,000–$50,000. Russian Market / Genesis Market and similar forums
• Stealer logs (combo lists) — "URL + ID + password" sets pulled from infected hosts, $2–$20 per bot
• Crypter / Packer services — "we will pack your malware so AV can't detect it", offered on subscription
• Bullet-proof hosting — servers (mostly) shielded from law enforcement. Heavily based in Russia, Eastern Europe, and China

"Don't run untrusted code" is the only true root defense. Expecting perfect judgment from ordinary users is unrealistic, so layered defense is the standard form.

The analysis workflow when a suspicious file (an odd email attachment, an unknown exe found on a shared PC) lands in your hands:

Summary #

• A Trojan is the "not self-replicating, not exploiting a vulnerability — the user installs it themselves" model. It targets human psychology as the primary vulnerability
• The modern profile is "no single-purpose, no single-stage" — multi-stage chains, IAB-to-RaaS labor division, supply-chain attacks, commercial spyware — the entire industry has been productized
• The defense root is "don't run untrusted code", but perfect user judgment is unrealistic → email filtering + macro disablement + EDR + MFA + backups + patching + Allowlisting as a layered defense
• "One layer stops everything" is the wrong frame. The 2026 standard mindset is "assume the Trojan gets through the first few layers; design how the later layers stop it"