Propagation mechanics: the worm scans network ranges, exploits reachable services (SMB, RDP, HTTP, databases), reuses stolen or default credentials, abuses administrative shares or copies itself onto USB drives. All without a single user click.
What is a computer worm?
A computer worm is a type of malware that replicates and spreads between systems on its own —across the network, via USB drives or through exposed services— without anyone opening a file and without infecting a host program. That autonomy is what sets it apart from the classic virus and the Trojan: once inside, it scans its surroundings, exploits a vulnerability or reuses credentials, copies itself to the next machine and repeats the cycle at machine speed.
Why does it matter?
Because a worm's defining trait is speed: it automates the lateral movement that would take a human attacker days. SQL Slammer infected some 75,000 servers within the first ten minutes back in 2003; WannaCry used the EternalBlue exploit (MS17-010, SMBv1) in May 2017 to encrypt hundreds of thousands of machines across 150 countries in a weekend; and NotPetya, weeks later, combined that same exploit with credential theft to flatten entire networks — Maersk had to rebuild 45,000 workstations, and global damage was estimated at around 10 billion dollars. The lesson still stands: on a flat network, a single unpatched machine compromises every other one, because nothing slows down internal traffic. That is why the defences that genuinely work against worms are structural: patch management prioritised on exposed services, network segmentation that turns an epidemic into a local incident, and early detection of the anomalous internal scanning every worm generates while hunting for its next victim.
Key points
Difference from viruses and Trojans: a virus needs a host file and a user action; a Trojan tricks someone into running it and does not replicate; a worm needs neither. Modern families combine all three: an initial-access Trojan with worm modules to spread.
The outbreaks that defined the category: Morris (1988, the first to take down the Internet), ILOVEYOU (2000), SQL Slammer (2003), Conficker (2008) and the 2017 double blow: WannaCry and NotPetya, which proved that credential theft lets a worm spread even between patched machines.
Modern payloads: the worm is the delivery mechanism, not the goal. Today it carries self-propagating ransomware, recruitment into botnets, cryptominers, or initial access that is later sold on — as with USB worms like Raspberry Robin.
Structural containment: segmentation with east-west traffic control, disabling SMBv1 and legacy protocols, prioritised patching of exposed services, and least privilege on service accounts so a stolen credential does not unlock the whole network.
Early detection: a worm is noisy — it generates internal scanning, spikes of connections to ports 445/3389 and chained authentications. NDR, SIEM rules on internal traffic and honeypots give it away within minutes if someone is watching.
Example: The same worm on a flat network and on a segmented one
An industrial company keeps an ageing Windows machine that controls a production line; it "cannot be touched" and has gone unpatched for years. The network is flat: office IT, servers and the factory floor share one segment. A contractor's laptop connects carrying a WannaCry-style worm. Within the hour the worm scans the full range, exploits SMBv1 on the legacy machine and on two servers missing MS17-010, and the ransomware it carries encrypts files across half the company, production line included. The downtime costs more than a decade of preventive maintenance would have.
The same intrusion on a segmented network ends differently: the infected laptop can only reach the guest segment, the internal firewall blocks SMB towards the plant and the servers, and the legacy system lives in an isolated zone reachable only from a jump host. The internal scanning trips an NDR alert in the SOC, which isolates the switch port within minutes. The outcome: one machine to rebuild instead of a corporate crisis. It was not the antivirus that made the difference — it was the architecture.
Common mistakes
- Keeping the network flat: if any machine can talk to any other on any port, a worm turns a single infection into a company-wide epidemic in minutes. Segmentation is the difference between an incident and a catastrophe.
- Declaring worms extinct. Mass outbreaks like 2003 are rare, but the technique is alive and well: ransomware with self-propagation modules, USB worms like Raspberry Robin and malware spreading via stolen credentials all use exactly the same principle.
- Leaving legacy systems unpatched and unisolated because they 'cannot be touched'. If you cannot patch, you compensate: isolate them in their own segment, filter ports, restrict access. An untouchable machine reachable from the whole network is both first victim and best springboard.
- Trusting the perimeter and ignoring east-west traffic. The worm does not come in through the corporate firewall: it arrives on a laptop, a USB stick or a VPN, and from there it sees nothing but internal network. Without internal traffic visibility, propagation is invisible until things start getting encrypted.
- Responding by powering machines off at random instead of isolating the network: the worm keeps jumping between whatever stays on, and volatile evidence is destroyed. The right order is to cut propagation (isolate segments and ports), preserve evidence, then eradicate under a proper incident response plan.
Related terms
Related services
This concept may be related to services such as:
Frequently asked questions
My company is small — do I really need to worry about worms like WannaCry?
Yes, precisely because worms do not pick their victims: they scan and exploit everything they find, and a small business with unpatched machines is statistically the most likely victim, not the least. WannaCry hit everything from hospitals to repair shops, indiscriminately. The good news is that the baseline defence is within any company's reach: keep patch management current, never expose SMB or RDP to the Internet, separate at least the guest and business networks, and keep offline backups. If there is no internal team to watch over it, a service like cybersecurity for SMBs covers exactly that front.
How do I stop a worm that is already spreading through my network?
Prioritise cutting propagation over cleaning individual machines: isolate network segments, block the ports the worm uses to spread (typically 445/SMB and 3389/RDP) on internal firewalls and switches, and disconnect affected machines from the network —without powering them off— to preserve evidence. Disconnect your backups too, so the worm cannot reach them. In parallel, identify the vulnerability or credential it is exploiting, because cleaning without closing that path guarantees reinfection. This is exactly the scenario where an incident response service makes the difference between hours and weeks of downtime.
What is the difference between a worm, a virus and a Trojan?
All three are malware, but they differ in how they arrive and how they spread. A virus infects legitimate files and needs someone to execute them in order to replicate. A Trojan disguises itself as legitimate software so the user installs it, and does not replicate on its own. A worm needs neither host nor user: it exploits the network to copy itself from machine to machine. In modern practice the boundaries blur — a typical campaign uses a Trojan for initial access and worm modules to spread, with ransomware as the final payload.
Do worms still exist today, or is this a threat from the past?
They are still active, though they have changed shape. Headline-grabbing outbreaks like SQL Slammer are rare because attackers now prefer stealth over noise, but self-propagation is very much a living technique: Raspberry Robin spreads via USB and serves as an entry point for ransomware groups; families like LockBit have shipped network self-propagation modules; and in cloud environments, worms hunt for exposed credentials and APIs to hop between services. Meanwhile, the population of machines still vulnerable to old exploits remains enormous — EternalBlue keeps finding victims nearly a decade on. The right question is not whether worms exist, but whether your network would stop one.