What Is Malware? Viruses, Ransomware and How to Stay Safe

In everyday life

Have you seen news like "A cyberattack shut down a company's factory and shipping"? Ransomware is often named as the cause. In Japan, the National Police Agency (NPA) says 226 cases were reported to police across the country in 2025. In January–June 2026, there were 123 cases. That is the most for any half-year since half-year counts began in the second half of 2020.

Personal phones and computers are targets too. A warning saying "Your device is infected with a virus" may have popped up on your screen. Some of these warnings are fake screens that appear even when nothing is infected.

What malware is: a name for software made to do harm

The word malware joins "malicious" and "software." Without the user knowing, it steals information, damages data or takes control of devices. It is not the name of one mechanism. It is a name for this whole group of software.

In Japan, people often use the word "virus" with the same meaning. A public website of Japan's Ministry of Internal Affairs and Communications also says "virus" is sometimes used in this broad sense. In the narrow sense, though, a virus is just one type in the table below. This article calls the whole group malware.

Making malware can also be a crime. In Japan, it is a crime to make or spread malware meant to run on other people's computers without a legitimate reason. Actually running it is also a crime. These offenses are in Article 168-2 of Japan's Penal Code, which took effect in July 2011.

Main types: the name depends on what you focus on

Each type is named for one of three things: how it multiplies, how it gets in, or what it aims to do. So one piece of malware often fits two or more types.

The name Trojan horse comes from Greek myth. In the story, a wooden horse with soldiers hidden inside was carried into a walled city as a gift. The name fits because this malware looks like handy software, so users install it themselves.

Among malware that steals information, infostealers ("information stealers") have stood out in recent years. They collect passwords, card numbers and similar data and send them to attackers. In May 2025, Microsoft worked with law enforcement agencies in several countries to shut down the infrastructure of one of them, called Lumma. Microsoft says it found infections on more than 390,000 Windows computers worldwide between March 16 and May 16 that year.

A bot lets someone control an infected device with commands from outside. Not only computers but also internet-connected security cameras and home routers are targeted. In some cases, many devices were controlled at once to attack other sites ("What Is IoT?").

How does it get in? Four main routes

Malware doesn't just appear out of nowhere. The four main routes below apply to both individuals and companies.

1. Email attachments

In one trick, an email posing as a reply from a business partner comes with a Word or Excel file. When you open it, it urges you to click "Enable Content." Office files can contain small programs that do tasks automatically. These are called macros, and clicking the button starts them and causes the infection. Emotet, which spread again in Japan in 2022, used this trick.

2. Fake apps and software from unofficial sources

These pretend to be popular apps or free software. Every year, Japan's IPA (Information-technology Promotion Agency) picks the "10 Major Information Security Threats." Its 2026 edition also includes damage from malicious apps. Install apps from official app stores or from the developer's official website.

3. Weak spots in software that hasn't been updated

Some mistakes in a program's design or code let attackers get in if they are abused. These are called vulnerabilities. They keep being found in operating systems, browsers, company network devices and more, and are fixed each time ("What Is an Operating System?").

WannaCry spread around the world in May 2017. It exploited a Windows vulnerability and spread from computer to computer inside networks. It was both a worm and ransomware. Microsoft had released an update fixing this vulnerability about two months earlier, in March 2017. Microsoft says computers with Windows Update turned on were protected.

Some attacks, however, exploit a weak spot before a fix is released. This is called a zero-day attack. Updates alone can't stop it, so other defenses are layered on top.

4. Phishing links

Links in emails or text messages lure you to fake sites. There, you are tricked into typing in passwords or installing malicious apps ("What Is Phishing?").

Companies have one more big way in. VPN devices let staff connect to the company network from outside. Remote desktop lets people operate a computer from somewhere else. In Japan, the NPA says the route was known in 100 cases in 2024. Of these, 55 came through VPN devices and 31 through remote desktop ("What Is a VPN?").

What does ransomware do?

The "ransom" in ransomware is money demanded to release something held hostage. The malware encrypts the files on company systems or computers without permission, so they can't be read. Then it demands money in exchange for restoring them.

Encryption is actually a technology for protecting data. It turns data into a form that people without the key can't read ("What Is Encryption?"). With ransomware, only the attacker has the key, so owners can't read their own data.

In attacks on companies, attackers often steal a copy of the data before encrypting it. Then they also threaten, "Pay, or we'll publish the stolen data." Because two threats are stacked, this is called double extortion. In Japan, the NPA says that of 134 cases in 2024 where the method was known, 111 (about 80%) were double extortion.

In some attacks, nothing is encrypted; the attacker only steals data and makes threats. The NPA calls this "no-ware ransom" and says 17 cases were reported in 2025. Here, even a backup can't stop the threat to publish the data.

Should you pay the ransom? What official agencies say

Japan's NPA explains two points about payment to victim organizations. First, the money paid may end up funding criminal groups. Second, paying doesn't guarantee that the encrypted data will be restored.

In the US, CISA, the agency responsible for cybersecurity, and its partners say in their guide that they do not recommend paying a ransom. Paying doesn't guarantee that your data will come back. Nor does it guarantee that stolen data won't be leaked or that attackers won't break in again.

Before deciding whether to pay, first talk to the police or a specialist company. In Japan, the Hyogo Prefectural Police also advise asking a system or security company for help before rushing to decrypt (restore) the data. For some kinds of ransomware, tools that restore the data have been published.

How to protect yourself: layer defenses instead of relying on one

No single measure stops everything. Combine measures that narrow the ways in with measures that limit the damage if attackers get in. The idea is the same at work and at home.

1. Keep software updated

Updates for operating systems, browsers, apps, routers and other devices close vulnerabilities that have been found. The basics: turn on automatic updates, and don't put off updates when you're notified. Old operating systems and devices whose support has ended no longer get updates.

2. Back up, and keep one copy disconnected

Keeping a copy of your data in another place is called a backup. It is the best preparation against ransomware encryption. But an external drive left plugged into the computer, or a shared folder, can be encrypted along with it. When Japan's NPA surveyed victim organizations in 2024, many could not restore their data from backups.

Japan's Tokyo Metropolitan Police Department recommends connecting the backup only while copying and disconnecting it afterward. It also helps to keep copies from several days and to test restoring now and then. A copy in the cloud isn't automatically safe either (see the common myths in "What Is Cloud Computing?").

3. Use multi-factor authentication

Multi-factor authentication checks that it's really you with a second method, such as your phone, as well as your password. A stolen password alone is then much harder to use for breaking in. It also helps if an infostealer steals your password ("How Are Passwords Cracked?").

4. Antivirus software and EDR

Antivirus software stops the malware it finds. It matches files against the features of known malware and watches for suspicious behavior. Windows 11 comes with antivirus software called Microsoft Defender. If you don't install other antivirus software, keep it turned on.

Companies also use products that keep a record of what happens on each computer. They spot suspicious activity after an intruder has gotten in. This is called EDR. Staff can look into what happened, and some products can cut a device off the network remotely ("Antivirus vs EDR vs XDR").

5. Use only the permissions you need day to day

Computers have powerful permissions for installing software and changing settings (administrator rights), and permissions for everyday work. To keep it simple here: malware basically runs with the permissions of whoever started it. If you normally use an account without administrator rights, damage spreads less easily. This idea of giving only the permissions needed is called the principle of least privilege.

At companies, limiting which folders each employee can open follows the same idea. Even if one computer is infected, the damage stays smaller.

6. Don't enable macros, and choose the apps you install

Don't open attachments you weren't expecting. If you've already opened one, don't click "Enable Content." Starting in 2022, Microsoft changed Office to block macros in files from the internet by default. If you see a message saying macros were blocked, check with the sender another way, such as by phone.

If you might be infected

Maybe a ransom note appeared on the screen, or files suddenly won't open. What you do first changes how far the damage spreads. The steps below are based on guidance from Japan's police and IPA. Outside Japan, contact your local police and your country's cybersecurity authority.

1. Disconnect from the network: Unplug the network cable and turn off Wi-Fi. This keeps the malware from spreading to other devices.
2. On a work device, don't turn it off; tell the person in charge right away: Police warnings in Japan ask people not to turn off or restart the device. Clues for finding out what happened could be lost. If your company has set procedures, follow them.
3. Report to the police and ask for advice: In Japan, companies report damage to the local police station or the prefectural police's cybercrime desk. If you're unsure, you can also call the police consultation line "#9110."
4. In Japan, individuals can ask IPA: IPA's "Information Security Safety Consultation Desk" gives advice about viruses and unauthorized access. The phone number is 03-5978-7509 (as of October 2026; weekdays 10:00–17:00).

If you installed a malicious app on your phone, IPA advises switching to airplane mode and deleting the app. After that, reset the device and change your passwords.

Common myths

By the numbers

The NPA figures count cases reported to police in Japan. Some damage is never reported, so they are not the total of all damage. Even so, the count has stayed high, at around 200 cases a year. Small and medium-sized businesses make up about 60%, so it's not only large companies that are targeted.

Learn more

• Tricks that fool you with fake emails and sites, and how to protect yourself: What Is Phishing?
• Vulnerabilities, and why operating system updates matter: What Is an Operating System?
• The danger of reusing passwords, and how multi-factor authentication works: How Are Passwords Cracked?
• How the encryption that ransomware abuses works: What Is Encryption?
• Why company VPN devices are targeted, and the idea of zero trust: What Is a VPN?
• What a firewall can't stop: What Is a Firewall?
• The Mirai case, where hijacked IoT devices were used in attacks: What Is IoT?
• A system that records file changes so you can go back to an earlier version: What Is Git?
• How antivirus software and EDR differ in their roles: Antivirus vs EDR vs XDR
• How an organization responds after an attack: incident response
• Attacks that use a business partner as a stepping stone: supply chain attack
• Ways to make backups: differential backup and incremental backup