8.2 Threats, Vulnerabilities & Malware

U.S. Air Force Cyber Test CSAT/ICTL

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

1.1 Current Exam Facts 1.2 Cyber AFSCs & Qualification Pipeline 1.3 How to Use This Guide & Study Plan

2 Number Systems & Encoding

2.1 Binary & Decimal Conversion 2.2 Hexadecimal & ASCII 2.3 Bitwise Operations & Two's Complement

3 Computing Architecture

3.1 Memory Hierarchy 3.2 CPU, Components & Data Path 3.3 Core Data Structures

4 Boolean Logic & Storage

4.1 Boolean Algebra & Logic Gates 4.2 Encoding, Files & Storage Concepts

5 Networking Models

5.1 OSI Model 5.2 TCP/IP Model & Encapsulation 5.3 Topologies & Transmission Media

6 Addressing & Subnetting

6.1 IPv4 Addressing 6.2 Subnetting & CIDR 6.3 IPv6 Fundamentals

7 Protocols & Network Services

7.1 TCP, UDP & Well-Known Ports 7.2 DNS & DHCP 7.3 Routing & Switching Basics

8 Cybersecurity Foundations

8.1 CIA Triad & Security Goals 8.2 Threats, Vulnerabilities & Malware 8.3 Social Engineering & Human Factors

9 Defensive Controls

9.1 Access Control & Authentication 9.2 Firewalls, IDS & IPS 9.3 SIEM & Defense in Depth

10 Programming Fundamentals

10.1 Variables, Types & Operators 10.2 Control Flow 10.3 Functions & Recursion

11 Languages & Debugging

11.1 Python Essentials for the Cyber Test 11.2 C++ Basics & Debugging Concepts

12 Operating Systems

12.1 Linux Fundamentals & Commands 12.2 Windows Fundamentals 12.3 Processes, Permissions & File Systems

13 Cryptography

13.1 Symmetric Encryption (AES) 13.2 Asymmetric Crypto & PKI 13.3 Hashing, MACs & Integrity

14 ICTL-Style Logic Reasoning

14.1 Deductive Logic & Syllogisms 14.2 Sequences & Pattern Recognition 14.3 Arrangement & Conditional Puzzles

15 Test Strategy & Mixed Review

15.1 Pacing, Elimination & AF Testing Day 15.2 Mixed Domain Review & Next Steps

8.2 Threats, Vulnerabilities & Malware

Key Takeaways Explain This Topic AI

A vulnerability is a weakness; a threat is a potential cause of harm that could exploit a weakness; risk is the combination of likelihood and impact if a threat exploits a vulnerability

Malware is software designed to harm, disrupt, or covertly control systems — types differ by propagation and payload behavior

Viruses need a host file and user/action help to spread; worms self-propagate across networks; trojans disguise malicious intent as legitimate software

Ransomware encrypts or locks data for extortion; spyware steals information; rootkits hide malware presence by subverting the OS or firmware view of the system

On the Cyber Test, classify the malware by how it spreads and what it does, and keep vulnerability/threat/risk vocabulary distinct

Last updated: July 2026

Before you memorize malware names, lock down three vocabulary words that appear throughout security and on aptitude-style cyber exams: vulnerability , threat , and risk . Misusing them loses easy points. Then learn the malware taxonomy — how each family spreads and what damage it typically does.

Vulnerability vs Threat vs Risk

Term Meaning Example

Vulnerability A weakness in a system, process, or person that could be exploited Unpatched OS, default admin password, open SMB share, missing input validation

Threat A potential cause of an unwanted incident — actor, event, or condition that could exploit a vulnerability Nation-state APT, ransomware gang, insider, accidental misconfiguration, natural disaster knocking out power

Risk The exposure that results when a threat might exploit a vulnerability — usually framed as likelihood × impact High likelihood of scanning + critical RCE vulnerability on an internet-facing host = high risk

Keep Them Straight

Leaving Remote Desktop open to the internet with a weak password is a vulnerability (and a bad practice).

A botnet that brute-forces RDP credentials is a threat (actor/capability).

The chance that the botnet succeeds and encrypts the mission share, times the operational impact of that outage, is the risk .

You mitigate risk by reducing vulnerabilities (patch, harden), reducing threat exposure (segment, block, deter), or reducing impact (backups, failover). Saying “we patched the threat” is sloppy language — you patched the vulnerability or reduced the risk.

Mission Framing

A cyber defender assessing a base network asks: What weaknesses exist (vulnerabilities)? Who or what might exploit them (threats)? What happens to the mission if they succeed (impact → risk)? That same chain of reasoning appears in CT-style scenario questions.

What Malware Is

Malware (malicious software) is software intentionally designed to disrupt, damage, steal, or gain unauthorized control. Delivery methods include email attachments, malicious links, infected removable media, drive-by downloads, supply-chain compromised updates, and lateral movement after an initial foothold.

Malware is often discussed by propagation method (how it spreads) and payload (what it does once running). One sample can combine traits — for example, a worm that drops ransomware — but exam questions usually test the defining trait named in the stem.

• Malware Taxonomy
• Virus

A virus attaches to a host file or boot sector and typically needs human action (opening a file, running a program) or execution of the infected host to spread further. Classic viruses infect executables or documents with macros. They do not, by definition, self-propagate across networks without some host and trigger.

• Recognition cue: “Attaches to files” / “spreads when infected programs run.”
• Worm

A worm is standalone malware that self-propagates across networks or systems, often by exploiting remote vulnerabilities or weak credentials, without needing a host file in the virus sense. Worms can consume bandwidth, open backdoors, and drop secondary payloads at scale.

• Recognition cue: “Spreads automatically over the network” / “no user click required after initial conditions.”
• Trojan (Trojan Horse)

A trojan disguises itself as legitimate or desirable software. The user (or an automated installer) runs it willingly under false pretenses. Trojans do not self-replicate like worms; their power is deception plus whatever payload they carry (remote access, credential theft, downloader).

• Recognition cue: “Looks like a useful app” / “user is tricked into installing.”
• Ransomware

Ransomware encrypts or locks access to data or systems and demands payment (often cryptocurrency) for restoration. Impact is primarily availability (and often integrity of stored data). Modern ransomware frequently arrives via phishing, trojans, or post-exploitation after credential theft, then spreads laterally before detonating.

• Recognition cue: “Files encrypted / locked until payment.”
• Spyware

Spyware secretly collects information — keystrokes, screenshots, browsing, credentials, microphone/camera — and exfiltrates it. Primary impact is confidentiality . Some spyware is bundled with seemingly legitimate software; some is installed after another compromise.

• Recognition cue: “Silently steals information / monitors activity.”
• Rootkit

A rootkit is designed to hide malware or attacker presence by subverting the operating system, boot process, or sometimes firmware so that files, processes, and network connections do not appear in normal tools. Rootkits enable persistence and stealth for other payloads.

• Recognition cue: “Conceals processes/files from the OS” / “hard to detect with standard tools.”
• Quick Comparison Table

• Type Spread / installation Typical primary harm
• Virus Needs host + execution path Varies (damage, theft, backdoor)
• Worm Self-propagates on networks Scale, bandwidth, rapid footholds
• Trojan Social/functional deception Whatever payload is hidden
• Ransomware Often via phish/trojan/lateral move Availability (extortion)
• Spyware Stealth install or bundle Confidentiality
• Rootkit Privilege + stealth hooks Concealment / persistence
• Exploitation Chain (How Pieces Fit)

Reconnaissance — threat actor finds exposed services or users.

Vulnerability — unpatched service, weak auth, or human trust.

Delivery — phishing email, exploit kit, infected USB, malicious update.

Installation / execution — trojan runs, worm spreads, virus infects hosts.

Actions on objectives — spyware steals, ransomware encrypts, rootkit hides C2.

Risk realized — mission data leaked, systems down, trust in telemetry broken.

Defenders interrupt the chain: patch and harden (shrink vulnerabilities), filter and authenticate (limit threat reach), detect and respond (cut impact), and back up offline (reduce ransomware impact).

• CIA Mapping for Malware Outcomes
• Spyware exfiltrating clearance-related PII → Confidentiality
• Worm flooding links until sensors cannot report → Availability (and possibly integrity if it alters hosts)
• Rootkit hiding altered system binaries → Integrity of the system view plus concealment
• Ransomware locking the mission share → Availability (with integrity of encrypted data)

When a question gives both a malware type and an effect, answer with the effect’s CIA pillar if asked for impact, or the malware type if asked for classification.

Practical Hygiene (Still Testable)

Keep systems patched; many worms succeed only on known vulnerabilities.

Do not run untrusted executables — trojans depend on that mistake.

Use least privilege so malware that runs has less to steal or encrypt.

Maintain offline or immutable backups against ransomware.

Monitor for unusual process hiding and integrity violations that suggest rootkits.

You do not need vendor brand names for the CT. You need clean definitions, clean distinctions among vulnerability/threat/risk, and the ability to classify malware by behavior.