Trojan

Description

The name is not an accident. As with the wooden horse outside Troy, the trick is that the victim opens the gate and lets the threat onto their own ground. Once running, a Trojan can do almost anything: open a backdoor, pull down further components, record what you do, or hand over full remote control. It is not the infection itself, only its carrier.

A Trojan is most often the first stage of an attack. Ransomware, infostealers, remote access tools — all of them tend to arrive this way, because a person clicking without a second thought is a more reliable way in than any vulnerability.

Examples

• An employee downloads a free version of an expensive program from a dubious site. It installs and it works — but hidden inside the installation comes a Trojan with unknown cargo.
• A fake installer for a popular tool is served through a search ad. The page looks official, the name matches, the icon is the same. The difference is one letter in the web address.
• A PDF reader taken from somewhere other than the official source does everything it should — while in the background it has brought along a keylogger that records every keystroke.

Notes

• The Trojan is not the goal — it is the courier, and it carries a record. Catching it leaves you the job of finding what it delivered.
• The surest defense against Trojans is a boring one: software comes only from the official source, and mail attachments are not opened without thinking. A crack or a free copy of a favorite application may cost nothing today; the bill arrives later, and it is larger.