Trojan Horse #

Trojan horse is the umbrella term for malware that disguises itself as legitimate software so that the user installs it voluntarily. The name comes from the Greek myth in the Iliad — soldiers hidden inside a giant wooden horse, brought into the city by the enemy themselves. The shape of that idea — "have the enemy open their own gate" — maps directly to the attack model "have the user click Install themselves."

Unlike a Virus or Worm, a Trojan doesn't self-replicate, and doesn't require an unpatched vulnerability, so infection succeeds even on a system without a single bug. The first step is always a user judgment error, and that's the substance of why Trojans have remained a primary attack surface for 30+ years.

The article structures the topic as "how Trojans relate to Virus / Worm / Ransomware / RAT in one diagram, modern functional sub-classes, the attack chain from delivery to objectives in another diagram (a MITRE ATT&CK miniature), persistence and evasion, representative incidents, the Malware-as-a-Service ecosystem, and defenses." Trojan is an old idea, but it's still by far the most common entry point for modern attacks — internalize that map first.

1. Where Trojan sits in the malware taxonomy #

News articles routinely use "virus," "malware," "Trojan," and "ransomware" interchangeably, but technically there's a sharp distinction by behavior and purpose. One piece of malware can sit in several categories at once (e.g., WannaCry = Worm + Ransomware), so a classification map keeps things organized.

The takeaways:

• Virus, Worm, and Trojan classify the spreading method. Independent of "what it carries" (Ransomware / Stealer / RAT). It's normal for one piece of malware to be multiple at once: "WannaCry is ransomware and a worm," "Emotet is a Trojan, a banking Trojan, a botnet client, and a loader."
• Trojan differs from Virus / Worm in that it doesn't self-replicate. Distribution is human-initiated (phishing, pirated downloads, malvertising).
• Backdoor (RAT) is the "remote-control interface the attacker uses after the Trojan let them in." That Cobalt Strike (originally a commercial pentest tool) became the standard tool of cybercrime is a dark-side fact of the industry.
• Rootkit is the "hide the other malware" concealment layer. Sometimes the Trojan itself is also a rootkit.

2. Modern functional sub-categories of Trojans #

Going one level finer, Trojans split by the attacker's economic objective:

"Modern Trojans aren't single-purpose; they're modular." The standard now is multi-stage chains like Emotet → Trickbot → BloodHound (AD recon) → Ryuk / Conti for encryption. Initial Access Brokers (IAB) even exist as specialized vendors who only sell initial access — labor-division has gone deep.

3. Delivery vectors — the 2026 reality #

The path a Trojan takes to reach the user's PC has changed considerably in the past 10 years. Office macro lockdown (Microsoft 2022) and OS-side hardening killed the old methods, and new delivery formats have appeared in their place:

• Phishing email attachments — still by far the top method. .docm (macro-laden Word) is in decline; in its place, .iso / .lnk / .one (OneNote) / .svg / .html smuggling are trending
• HTML smuggling — the email body is HTML that assembles a zip in the browser via JavaScript. EDR can't catch it as a file attachment
• Malvertising — the top-of-search paid ad pretends to be "download " (real cases: PuTTY, Notion, OBS, VS Code). Google Ads frequently fails at cleaning these up — a long-standing problem
• Pirated / cracked software — Adobe / Office / game cracks come bundled with Trojans. "Anything free" carries inherent risk
• Vishing (voice-based social engineering) — "I'm from IT support, your PC is compromised, install this tool from this link." Attackers operate legitimate AnyDesk / TeamViewer remotely
• USB drops — drop 100 USBs labeled "Salaries 2026" in the parking lot. Still works against corporate targets
• Drive-by download — browser vulnerabilities → infected just by visiting. Made hard by Chrome/Firefox/Edge sandboxes, but zero-days do succeed
• Supply-chain — poison the legitimate software's update channel to ship to all customers. Examples: SolarWinds Sunburst (2020), 3CX (2023), XZ utils backdoor (2024)
• Living off Trusted Sites — abusing GitHub / Discord / Telegram / Cloudflare R2 / AWS S3 for malware distribution and C2. "Surely not from such a major service" becomes the attacker's shield

4. Attack chain — initial access through objectives #

Following Trojan behavior in MITRE ATT&CK Tactics order reveals the path from "the click" to "ransomware execution." It also matches the Lockheed Martin Cyber Kill Chain.

Stopping the chain at any one stage minimizes damage:

• Stop at stages (1)–(2) = email filtering / macro disable / no pirated SW / Application Allowlisting (most effective)
• Stop at stages (3)–(5) = EDR behavioral detection / proxy blocks for known C2 domains (the modern frontline)
• Stop at stages (6)–(9) = LSASS protection / network segmentation / Tier admin / honey tokens
• Stop at stage (10) = essentially too late. Backups are the last line of business continuity

5. Persistence and evasion — staying alive #

Malware's largest challenge is "survive a reboot." The classic Windows Persistence techniques:

• Registry Run keys — write to HKCU\Software\Microsoft\Windows\CurrentVersion\Run. Oldest and easiest to find
• Scheduled Task — schtasks /create for run-at-logon
• Service — sc create to register as a Windows service (runs as SYSTEM)
• DLL hijacking — drop a DLL into a directory the legit EXE searches first
• COM hijacking — rewrite COM CLSIDs in the registry
• WMI Event subscription — install a WMI event hook for periodic execution (hard to detect)
• Bootkit / UEFI rootkit — runs before the OS even starts (LoJax, MoonBounce, BlackLotus)

The classic Defense Evasion patterns:

• Packers / Crypters — UPX / Themida / commercial packers / custom crypters encrypt the code, decrypt at runtime. Defeats AV signatures
• Polymorphic / Metamorphic — mutate code on every infection so signatures don't match
• Code-signing certificate abuse — sign with stolen vendor certificates (Stuxnet used Realtek / JMicron certs)
• Process injection / hollowing — inject the malicious code into a legitimate process (explorer.exe, svchost.exe)
• Living off the Land Binaries (LOLBins) — achieve malware-equivalent behavior using legitimate system tools like powershell, mshta, certutil, regsvr32, rundll32, bitsadmin (catalogued at LOLBAS Project)
• Sandbox detection — look for VM / sandbox tells (low RAM, accelerated sleep, specific drivers) and self-terminate
• Sleep / Stalling — sleep for hours or days before doing anything; defeats short-window sandbox analysis

6. Representative Trojans through history #

"Trojans haven't faded over 35 years; they've gotten more sophisticated" is the actual record. Supply-chain attacks in particular are extremely hard to defend, and the XZ utils incident (2024) — "a backdoor was about to ship to essentially every Linux" — was a wake-up call to the industry.

7. Malware-as-a-Service and the modern ecosystem #

The "lone hacker writes and ships" model has evolved into a division-of-labor commercial ecosystem. The structure resembles the legitimate software industry:

• MaaS (Malware-as-a-Service) — malware authors rent it out monthly / per-use to other criminals. RedLine Stealer is $200/month; LockBit takes 20% of every ransom for the author
• RaaS (Ransomware-as-a-Service) — the specialized form of the above. "Affiliates" handle intrusion; HQ does the encryption and negotiation
• IAB (Initial Access Brokers) — traded "footholds in company X (RDP/VPN credentials)" at $1,000 to $50,000 each on forums like Russian Market / Genesis Market
• Stealer logs (combo lists) — "URL + ID + password" sets extracted from infected hosts, $2 to $20 per bot. Buy and use directly for attacks
• Crypter / Packer services — "we'll repack your malware to evade AV detection" — subscriptions
• Bullet-proof hosting — server services that (mostly) survive law-enforcement takedowns. Largely Russia / Eastern Europe / China

The fully-divided economy where "buy access from an IAB, encrypt via RaaS, buy stealer logs separately" is what made $50M+ ransomware attacks possible. MGM Resorts (2023, $100M+ losses) and Change Healthcare (2024, $22M ransom paid + $872M total losses) were both born from this model.

8. Defense — the only root fix and the realistic layered approach #

"Don't run untrusted code" is the only true root defense. But expecting perfect judgment from ordinary users is unrealistic, so the standard form is layered defense:

The five minimums for an individual user: (1) don't open email attachments by default, (2) enable auto-update on OS and browser, (3) enable MFA (Authenticator app), (4) don't install pirated / cracked software, (5) keep MS Defender / macOS XProtect / Linux ClamAV active. That alone neutralizes ~90% of Trojan attacks.

9. Analysis approach — when a suspicious file lands in your hands #

When you obtain a suspicious file (a sketchy attachment, an unknown EXE on a shared PC), the analysis sequence:

# The minimum check sequence (Linux host)
file suspicious.exe                       # file type
sha256sum suspicious.exe                  # hash → search key for VT
strings -a -n 8 suspicious.exe | head -50 # examine strings (URLs / API names / mutex names)
exiftool suspicious.exe                   # metadata
upx -d suspicious.exe 2>/dev/null         # if UPX-packed, unpack
clamscan -i suspicious.exe                # quick AV scan

# Submit to a sandbox (Any.Run via browser / VirusTotal via CLI)
curl -F "file=@suspicious.exe" -H "x-apikey: YOUR_KEY" \
     "https://www.virustotal.com/api/v3/files"

Never run it on production or your personal PC. Use an isolated VM (VMware / VirtualBox with snapshot) or a disposable cloud VM, or an online sandbox (Any.Run). Cut the network or restrict it through an analyzer's MITM proxy — this is the baseline.

A Trojan horse is a malware-delivery model that targets human psychology as the primary vulnerability — not self-replication, not vulnerability exploitation, but getting the user to install it themselves. No matter how correct the code or how strong the cryptography, the moment the user clicks "Run," it's over — and that property is why Trojans remain a primary attack class even after 35 years.

The modern character is "never standalone" — multi-stage chains like Emotet → Trickbot → Conti, a fully labor-divided commercial ecosystem from Initial Access Broker to RaaS, supply-chain attacks like SolarWinds / 3CX / XZ utils, state-grade commercial spyware like Pegasus — wherever you slice it, the industry has scaled up.

The defense is "don't run untrusted code" at the root, but demanding perfection from ordinary users isn't realistic, so the practical answer is layered defense: email filtering + macro disable + EDR + MFA + backups + patches + Application Allowlisting. The 2026 standard mindset isn't "block it all in one layer"; it's "Trojans will inevitably get through the first few layers — how do we stop them at the later stages?"