While we still use many of the same old names—viruses, Trojans, and worms—today’s malware deserves much more respect than many are giving it. Where traditional viruses mostly aimed to disrupt operations or win fame for their coders’ cleverness, today’s malware enables potent multistage attacks called advanced persistent threats. In these carefully sequenced attacks, criminals rely on custom and constantly changing malware placed where it will go unnoticed, returning the maximum value from their investment.

This paper describes how malware enables these advanced persistent threats. Three case studies explain how enterprise information security and incident response (IR) teams can employ cyberforensics tools to minimize the damage.