THE TECH PRAXIS

where buzzwords go to get cross-examined

Cybersecurity / Mythbusting

Not All Ransomware Is a Worm

Somewhere, right now, a LinkedIn post is calling a phishing email "basically a worm." This is an intervention.

Here's a magic trick: say the word "ransomware" in a room full of IT people, and watch at least one of them say "you mean like that worm thing?" It's not their fault, exactly — cybersecurity vocabulary has been marinating in sloppy journalism for two decades. But it's time someone said the quiet part loudly: propagation and payload are not the same axis, and confusing them is like confusing a delivery van with the pizza inside it.

01	The Classification Error

Malware doesn't have one identity. It has two, filed under completely different departments:

Propagation — how it travels. Think of it as the malware's Uber driver.
Payload — what it does once it arrives. Think of it as the reason you called the Uber in the first place.

A worm is a transport method. Ransomware is an intention. One can absolutely ride the other — but neither cancels the other out. Calling something "a worm" tells you nothing about what it wants from you. Calling something "ransomware" tells you nothing about how it got past your firewall. Treating them as synonyms is how otherwise smart people end up drawing the wrong incident-response diagram at 2 a.m.

A worm tells you how malware travels. Ransomware tells you what it ultimately wants. Confusing the two is rather like confusing an aircraft with its destination.

02	The Malware Matrix

Once you separate the two axes, the whole "wait, so is it a worm or ransomware" argument stops being an argument and starts being a two-column table. Which, conveniently, is exactly what it is:

PROPAGATION User executes file

PAYLOAD Information theft

→ Trojan Spy

PROPAGATION Self-spreading

PAYLOAD Remote control

→ Worm-Based Botnet

PROPAGATION User executes file

PAYLOAD Encryption

→ LockBit, Ryuk, Conti

PROPAGATION Self-spreading

PAYLOAD Encryption

→ WannaCry

Notice something? "Encryption" shows up twice, in two totally different rows. That's the whole scandal, right there. The payload can stay identical while the delivery mechanism completely changes character — which is exactly why lumping them into one label produces confused headlines and worse incident reports.

03	Why WannaCry Broke the Internet's Brain

Here's the plot twist people miss: WannaCry wasn't famous for encrypting files. Ransomware had been doing that quietly for years, like a burglar with excellent manners. What made WannaCry different is that it weaponized the EternalBlue exploit (MS17-010) and figured out how to let itself in — no phishing email, no gullible intern clicking "Enable Macros."

Within hours, it had casually strolled through hospitals, railways, manufacturers, and government agencies like it owned the place:

230,000+ COMPUTERS AFFECTED

150+ COUNTRIES IMPACTED

The ransomware didn't need to be delivered by anyone. It delivered itself — RSVP'd, showed up, and let itself into the building. That's the distinction the "is it a worm" crowd keeps missing: the payload was ordinary; the propagation was the plot twist.

The ransomware wasn't merely delivered. It delivered itself. That distinction changed everything.

04	Why LockBit Isn't Auditioning to Be a Worm

LockBit. Ryuk. Conti. Black Basta. Names that dominate ransomware headlines the way certain relatives dominate family WhatsApp groups. And yet — none of them are classic self-spreading worms. Their actual method of operation reads less like an epidemic and more like a heist movie with a very patient crew:

Steal credentials via phishing → slip in through VPN or RDP → escalate privileges → move laterally, quietly, like someone checking every door on a floor → disable security tools → hunt down the backups (the real target) → exfiltrate the data first, just in case → and only then, deploy the encryption.

Encryption is the closing scene, not the opening one. Some variants do automate lateral movement once they're inside — efficient, sure — but automating your internal commute doesn't make you a worm. It makes you a very organized houseguest.

Some variants automate lateral movement inside an already compromised network. That improves efficiency. It does not transform them into autonomous worms.

05	Modern Ransomware Outsourced the Hard Part

Here's the delicious irony: worms are becoming less common precisely because cybercrime got its act together. Why write self-propagating code when you can rent access from an Initial Access Broker like it's a WeWork desk? The modern ecosystem runs on Ransomware-as-a-Service, credential marketplaces, living-off-the-land techniques, and double (occasionally triple) extortion. The malware doesn't need legs anymore — the gig economy built it a chauffeur.

06	The Praxis Take

"Is it ransomware?" is a lazy question dressed up as a smart one. It answers half of nothing. The questions that actually determine your defense strategy are the unglamorous ones: How did it arrive? How did it persist? What was the payload? How was command-and-control maintained? What enabled lateral movement? The malware's brand name makes for a punchier headline. It has never once stopped a breach.

Final thought: A worm describes the journey. Ransomware describes the mission. Effective cybersecurity starts the moment we stop asking "what is it?" and start asking "how does it actually work?" Everything else is just vocabulary cosplay.

THE TECH PRAXIS — decoding technology, one misconception at a time