Computer Worm.

A computer worm is malware that spreads by exploiting network services, open shares, or unpatched vulnerabilities, copying itself from system to system without needing to attach to a host program. Worms can saturate links, degrade services, deliver secondary payloads like ransomware or backdoors, and reach internal systems that are not directly exposed to the internet.

How worms propagate. A worm scans for reachable hosts, tests each against an exploit or credential set, and installs a copy that repeats the cycle — growth is exponential until the vulnerable population is exhausted or the network collapses under the scan traffic. The 2003 SQL Slammer worm weaponised a buffer overflow in the SQL Server 2000 Resolution Service (patched by MS02-039 six months earlier) using a single 376-byte UDP packet to port 1434; it doubled its infected population roughly every 8.5 seconds and knocked large swaths of the internet offline within minutes. Conficker (2008) chained the MS08-067 RPC flaw with USB autorun and dictionary attacks on shares, building a botnet of millions. WannaCry (2017) fused the leaked EternalBlue SMBv1 exploit (MS17-010) with ransomware, and Stuxnet crossed air gaps via infected USB drives to reach Iranian centrifuge controllers.

Defences include rapid patching of network-facing services, disabling legacy protocols (SMBv1, weak RDP), network segmentation to break lateral reachability, egress filtering, rate-limiting outbound scan traffic, and detection of anomalous east-west connection fan-out.

flowchart LR
  A[Infected host] --> B[Scan network for<br/>vulnerable service]
  B --> C{Target<br/>vulnerable?}
  C -->|No| B
  C -->|Yes| D[Exploit / weak credential]
  D --> E[Copy worm to target]
  E --> F[New host runs worm]
  F --> B
  E --> G[Drop secondary payload<br/>ransomware / backdoor]