The History of Computer Viruses and Malware

The History of Computer Viruses and Malware

Computer malware, a portmanteau of malicious software, encompasses any code written to alter, destroy, or steal data, or to hijack computing resources without authorization. The history of malware is a chronological record of the arms race between software developers and attackers. This history reflects the broader evolution of computing architectures, transitioning from isolated mainframes and floppy disks to globally interconnected networks, cloud infrastructure, and the Internet of Things.

In the earliest decades of computing, self-replicating programs were theoretical exercises or benign experiments conducted by academics and engineers. As personal computers became consumer commodities in the 1980s, these concepts materialized as viruses transmitted via removable media. The proliferation of the internet in the 1990s and 2000s catalyzed a transition from localized viruses to self-propagating network worms, enabling rapid global infections. During this period, the motivations behind malware creation shifted from vandalism and technical curiosity to organized financial crime.

Today, malware development is a highly professionalized industry and a standard instrument of statecraft. Modern malicious software includes ransomware, cryptojackers, and advanced persistent threats designed to evade detection while extracting financial value or disrupting critical infrastructure.^[11] Understanding the technical and commercial constraints that shaped these developments explains how vulnerabilities in software design and human psychology have been exploited over the past seven decades.

Theoretical Foundations and Early Experiments (1949 to 1980)

The conceptual foundation for self-replicating software was established long before the first computer virus was written in code. In 1949, mathematician John von Neumann delivered a series of lectures at the University of Illinois titled "Theory and Organization of Complicated Automata." He proposed that a machine could theoretically reproduce itself if it contained a set of instructions and a mechanism to execute those instructions. He modeled this using cellular automata on a two dimensional grid. These lectures were later compiled and published in 1966 as Theory of Self-Reproducing Automata^[1], establishing the mathematical basis for what would eventually become computer viruses.

In 1961, programmers at Bell Telephone Laboratories, including Victor Vyssotsky, Robert Morris Sr., and Doug McIlroy, created a game called Darwin. The game ran on an IBM 7090 mainframe and involved competing programs written in assembly language that attempted to overwrite each other in the memory of the computer. This concept was later formalized in 1984 by A.K. Dewdney in Scientific American as Core War^[2]. In Core War, programs called "warriors" written in a specialized assembly language called Redcode battled for control of a simulated virtual machine known as the Memory Array Redcode Simulator. While Darwin and Core War were contained simulations, they demonstrated that code could be designed to autonomously replicate and attack other code.

The first instance of a self-replicating program operating outside a simulated game environment was Creeper^[3].^[12] Written in 1971 by Bob Thomas at Bolt, Beranek and Newman, Creeper was an experimental program designed to move between DEC PDP-10 mainframe computers running the TENEX operating system on the ARPANET. Creeper was not malicious. It simply displayed the message "I'M THE CREEPER : CATCH ME IF YOU CAN" on the teletype and then moved to another system, rather than leaving a copy of itself behind. Shortly after, Ray Tomlinson modified Creeper to self-replicate, creating the first true computer worm. Tomlinson also wrote a program called Reaper, which moved through the ARPANET specifically to find and delete copies of Creeper, effectively making Reaper the first antivirus software.

In 1975, programmer John Walker created ANIMAL for the UNIVAC 1108. ANIMAL was a popular twenty questions style game that attempted to guess the animal a user was thinking of. Walker wanted to share the game with other users, but magnetic tapes were cumbersome. He wrote a subroutine called PERVADE that ran in the background, checking all directories the user had access to and copying the ANIMAL program into any directory where it was not already present. While completely benign and intended only for distribution, ANIMAL is widely considered the first Trojan horse in the wild, as it performed unprompted background actions without the explicit knowledge of the user.

The PC Era and Boot Sector Viruses (1981 to 1989)

The introduction of the Apple II and the IBM Personal Computer brought computing into homes and small businesses. This decentralized architecture relied heavily on floppy disks for software distribution and data transfer, creating a perfect vector for localized malware.

In 1982, a fifteen year old high school student named Rich Skrenta wrote Elk Cloner^[4], the first personal computer virus to spread widely outside a laboratory. Elk Cloner targeted the Apple DOS 3.3 operating system. It was a boot sector virus, meaning it embedded itself in the startup code of a floppy disk. When a computer booted from an infected disk, the virus loaded into the computer memory. If an uninfected disk was subsequently inserted, Elk Cloner copied itself to the new disk. The virus was relatively harmless, designed as a prank. On the fiftieth boot, it displayed a short poem on the screen. Elk Cloner demonstrated how easily self-replicating code could propagate through human behavior and physical media sharing.

The first virus to target the IBM PC emerged in 1986. Known as Brain, it was written by two brothers, Basit and Amjad Farooq Alvi, who operated a computer store in Lahore, Pakistan. The brothers created Brain to track the unauthorized copying of their medical software. Like Elk Cloner, Brain was a boot sector virus. It replaced the boot sector of a floppy disk with a copy of the virus and moved the original boot sector to another sector, marking it as "bad" so the operating system would not overwrite it. Brain also included a rudimentary stealth mechanism. If the operating system attempted to read the infected boot sector, the virus intercepted the request and provided the original, uninfected boot sector instead. The virus included the names, address, and phone numbers of the brothers, urging infected users to contact them for a cure. The Brain virus, while not intentionally destructive, caused significant disruption because it consumed valuable floppy disk space and slowed down floppy drive operations. The Alvi brothers were overwhelmed by phone calls from around the world as the virus spread far beyond their local market in Pakistan, illustrating the unexpected global reach of physical media sharing.

As the decade progressed, viruses became more destructive. The Jerusalem virus, discovered in 1987 in Israel, infected executable files rather than boot sectors. It was programmed to delete all executed files on Friday the 13th. This logic bomb payload caused widespread data loss when it triggered in May 1988, highlighting the need for dedicated security software and regular data backups.

The defining malware event of the 1980s occurred on November 2, 1988, when Cornell University graduate student Robert Tappan Morris released a self-propagating program onto the early internet. The Morris Worm^[5] exploited vulnerabilities in Unix systems, specifically the sendmail and fingerd protocols, as well as weak passwords. Morris intended the worm to measure the size of the internet, but a flaw in his code caused the worm to infect machines multiple times, consuming system resources and grinding thousands of computers to a halt. The incident affected major research institutions and military networks, prompting the creation of the first Computer Emergency Response Team at Carnegie Mellon University. Morris became the first person convicted under the 1986 Computer Fraud and Abuse Act.

The decade also saw the first instance of ransomware. In 1989, evolutionary biologist Joseph Popp distributed twenty thousand floppy disks labeled "AIDS Information - Introductory Diskettes" to attendees of a World Health Organization conference. The disk contained a Trojan horse that, after ninety reboots, hid directories and encrypted file names on the victim hard drive. It then displayed a message demanding a payment of 189 dollars to a post office box in Panama. The AIDS Trojan was poorly coded and easily reversed, but it established the conceptual framework for digital extortion.

The Rise of Macro Viruses and Polymorphism (1990 to 1998)

The 1990s brought significant changes to software environments, particularly the dominance of the Microsoft Windows operating system and the Microsoft Office suite. Malware authors adapted to these new platforms, developing techniques to evade the nascent antivirus industry.

Early antivirus software relied on signature detection, scanning files for known strings of malicious code. In response, malware authors developed polymorphic engines. A polymorphic virus encrypts its payload and alters its decryption routine each time it infects a new file, ensuring that no two infections share the exact same code signature. The Tequila virus, discovered in 1991, was one of the first widespread polymorphic viruses. Shortly after, a Bulgarian malware author known as Dark Avenger released the Mutation Engine, a modular polymorphic generator that other virus writers could link to their own code, instantly making their viruses polymorphic. This escalated the technical complexity required for antivirus scanners, forcing them to implement heuristic analysis and virtualized sandboxes to detect malicious behavior rather than static signatures.

The mid 1990s saw the emergence of macro viruses. Microsoft Word and Excel included powerful scripting languages designed to automate repetitive tasks. Malware authors realized these macros could be used to write viruses that infected documents rather than executable programs. The Concept virus, discovered in 1995, was the first macro virus to spread in the wild. It infected Microsoft Word documents and spread rapidly because users frequently shared documents via email and corporate networks. Macro viruses were platform independent, capable of infecting both Windows and Macintosh systems as long as they ran Microsoft Office.

In 1999, the Melissa virus combined the document infection of macro viruses with the global reach of email. Written by David L. Smith, Melissa^[6] arrived as a Word document attachment. When opened, the macro code accessed the Microsoft Outlook address book of the victim and emailed copies of itself to the first fifty contacts. Melissa overwhelmed corporate email servers worldwide, forcing major companies to shut down their gateways. The virus caused an estimated 80 million dollars in lost productivity and cleanup costs, demonstrating the devastating speed of email based propagation. Smith was tracked down by the FBI with the help of AOL and a hidden globally unique identifier embedded in the Word document by Microsoft Office. He was sentenced to twenty months in federal prison, marking a significant victory for cyber law enforcement.

The era also witnessed highly destructive payloads. The CIH virus, also known as Chernobyl, was discovered in 1998. Written by Chen Ing-hau, CIH was unique because it targeted computer hardware. On its trigger date, the virus attempted to overwrite the Flash BIOS of the infected motherboard, rendering the computer completely unbootable and requiring physical hardware replacement. CIH caused massive damage, particularly in Asia, and proved that software could destroy physical computing infrastructure.

The Internet Worm Era (1999 to 2005)

The proliferation of broadband internet access in the early 2000s created an environment ripe for massive, fast spreading network worms. Unlike early viruses that required human interaction to spread via floppy disks or email attachments, these new worms exploited network vulnerabilities to propagate autonomously across the internet.

The transition began with social engineering. In May 2000, the ILOVEYOU^[7] worm infected tens of millions of computers within hours. Written in VBScript by two programmers in the Philippines, the worm arrived in an email with the subject line "ILOVEYOU" and an attachment named "LOVE-LETTER-FOR-YOU.TXT.vbs". Because Windows hid file extensions by default, the attachment appeared to be a harmless text file. When executed, the script overwrote image and audio files, stole passwords, and emailed itself to every contact in the Outlook address book of the user. ILOVEYOU caused billions of dollars in damage and forced organizations worldwide to implement strict email filtering policies.

In 2001, the Code Red worm shifted the paradigm by exploiting a buffer overflow vulnerability in Microsoft Internet Information Services web servers. Code Red required no user interaction. It scanned random IP addresses for vulnerable servers, injected its payload directly into memory, and commanded the infected server to scan for more victims. The worm also included a payload designed to launch a distributed denial of service attack against the website of the White House. Later that year, the Nimda worm utilized multiple vectors, spreading via email, open network shares, compromised websites, and the same IIS vulnerability used by Code Red.

The speed of autonomous worms peaked in January 2003 with the SQL Slammer worm. Slammer exploited a vulnerability in Microsoft SQL Server. Because the entire worm was only 376 bytes long, it fit inside a single UDP packet. This allowed it to spread as fast as the infected network interface could transmit data. Slammer infected over 75,000 servers in just ten minutes, causing severe internet congestion that disrupted airline flights, automated teller machines, and emergency services.

In 2004, the MyDoom worm became the fastest spreading email worm in history, a record it holds to this day. MyDoom utilized a backdoor to allow remote access to infected machines and launched denial of service attacks against the SCO Group and Microsoft. The same year, the Sasser worm exploited a vulnerability in the Windows Local Security Authority Subsystem Service, while the Blaster worm had exploited a vulnerability in the Remote Procedure Call service in 2003. The Blaster worm contained a hidden message directed at the CEO of Microsoft: "billy gates why do you make this possible? Stop making money and fix your software!!" These worms caused infected computers to continuously reboot, affecting millions of home users. This era of rapid, automated exploitation forced the software industry to adopt secure development lifecycles and automated patch management systems, prompting Microsoft to fundamentally change its security posture with the release of Windows XP Service Pack 2, which enabled the Windows Firewall by default.

Botnets, Rootkits, and Financial Crime (2006 to 2012)

By the mid 2000s, the motivations of malware authors had shifted decisively. The era of writing viruses for notoriety or vandalism ended, replaced by organized cybercrime focused on financial gain. Malware became stealthier, designed to remain undetected on victim machines for as long as possible to harvest data and computing resources.

This shift gave rise to the botnet, a network of compromised computers controlled by a central command and control server. Botnets were used to send spam, host phishing sites, and launch distributed denial of service attacks for extortion. The Zeus banking trojan, first identified in 2007, became the standard tool for financial theft. Zeus infected machines via drive by downloads and phishing emails. Once installed, it used keystroke logging and form grabbing to steal banking credentials when the user logged into their financial institution. The Zeus source code was eventually leaked, leading to countless variants and cementing its legacy as one of the most successful financial malware families.

To maintain persistence, malware authors increasingly utilized rootkits, software designed to hide the existence of other processes or files from the operating system. In 2005, a major scandal erupted when it was discovered that Sony BMG had included a rootkit on millions of audio CDs. The software, intended as digital rights management to prevent copying, installed itself silently, hid its files, and created vulnerabilities that malicious software later exploited. The Sony BMG incident blurred the line between commercial software and malware, highlighting the dangers of subverting operating system security.

In 2008, the Conficker worm infected millions of Windows machines by exploiting a vulnerability in the Server Service. Conficker was notable for its sophisticated defense mechanisms. It disabled antivirus software, blocked access to security vendor websites, and used a domain generation algorithm to contact a different command and control server every day. Conficker was so resilient that it prompted the formation of the Conficker Working Group, an unprecedented coalition of security researchers, internet service providers, and law enforcement agencies. The group successfully blocked the domains generated by the worm, preventing the attackers from updating the malware or monetizing the massive botnet.

The most significant development of this era occurred in 2010 with the discovery of Stuxnet^[8]. Stuxnet was a highly complex, state sponsored computer worm designed specifically to sabotage the nuclear enrichment facilities of Iran at Natanz. The worm spread initially via USB flash drives to bypass the air gapped network of the facility. Once inside, it exploited four separate zero day vulnerabilities in Windows to propagate. Stuxnet specifically sought out Siemens Step7 software, which was used to program industrial programmable logic controllers. The worm altered the code on the controllers to spin the nuclear centrifuges at destructive speeds while simultaneously playing back normal operating data to the plant operators, hiding the sabotage. Stuxnet marked the first time a cyber weapon caused physical destruction to critical infrastructure, fundamentally altering the landscape of international conflict.

Ransomware and Advanced Persistent Threats (2013 to 2019)

The 2010s were defined by the rise of ransomware and the proliferation of advanced persistent threats. While the concept of ransomware existed since the AIDS Trojan in 1989, it only became a viable criminal enterprise with the advent of cryptocurrency, which provided a decentralized, pseudonymous method for collecting extortion payments.

In 2013, CryptoLocker revolutionized the malware landscape. Distributed primarily via the Gameover Zeus botnet, CryptoLocker used strong RSA public key cryptography to encrypt the documents and photographs of the victim. The private key required to decrypt the files was held on the server of the attacker. Victims were given a deadline to pay a ransom in Bitcoin, after which the private key would be deleted. CryptoLocker proved highly lucrative, spawning an entire industry of ransomware families, including Locky, Cerber, and TeslaCrypt.

The destructive potential of ransomware reached a global crisis in May 2017 with the WannaCry outbreak. WannaCry was a ransomware worm that spread autonomously using EternalBlue, an exploit developed by the United States National Security Agency that had been stolen and leaked by a group known as the Shadow Brokers. EternalBlue exploited a vulnerability in the Windows Server Message Block protocol. WannaCry infected hundreds of thousands of computers in over 150 countries within hours. It severely disrupted the National Health Service in the United Kingdom, leading to canceled surgeries and diverted ambulances. The WannaCry outbreak was only halted when a British security researcher named Marcus Hutchins discovered a hardcoded domain name within the malware code. By registering the domain, Hutchins inadvertently activated a kill switch that stopped the worm from spreading further, though the damage already inflicted was catastrophic.

A month later, another malware variant known as NotPetya utilized the same EternalBlue exploit. While NotPetya masqueraded as ransomware, its encryption routine was irreversible, making it a wiper designed purely for destruction. The attack initially targeted Ukrainian accounting software, but it spread rapidly through multinational corporations doing business in Ukraine, including shipping giant Maersk and pharmaceutical company Merck. NotPetya caused an estimated 10 billion dollars in global economic damage, making it the most destructive cyberattack in history. The United States and its allies officially attributed NotPetya to the Russian military intelligence agency GRU.

During this period, the proliferation of poorly secured Internet of Things devices created new vectors for malware. In 2016, the Mirai botnet infected hundreds of thousands of internet connected cameras and home routers by scanning for devices using default factory usernames and passwords. Mirai harnessed these devices to launch massive distributed denial of service attacks, including an attack on the DNS provider Dyn that disrupted access to major websites across the eastern United States.

Modern Malware Ecosystems and Supply Chain Attacks (2020 to Present)

In the current decade, malware operations have evolved into highly structured enterprises. The ecosystem is characterized by specialization. Initial access brokers focus solely on breaching corporate networks, selling that access to ransomware affiliates who deploy the actual encryption malware. This model, known as Ransomware as a Service, operates much like a legitimate software franchise. Core developers maintain the malware code, manage the payment portals, and handle negotiations with victims. Affiliates purchase access to the malware and are responsible for breaching networks and deploying the payload. The profits are then split, typically with the affiliate keeping the majority. This division of labor has drastically increased the volume and sophistication of ransomware attacks.

In May 2021, the DarkSide ransomware group compromised the corporate network of the Colonial Pipeline Company, which supplies nearly half of the fuel consumed on the East Coast of the United States. To prevent the malware from spreading to operational technology networks, the company proactively shut down the pipeline, leading to widespread fuel shortages and panic buying. The Colonial Pipeline cyber incident^[9] forced the United States government to declare a regional state of emergency. The company paid a 4.4 million dollar ransom in Bitcoin, though the Department of Justice later recovered a significant portion of the funds.

State sponsored actors have also refined their techniques, increasingly utilizing supply chain attacks to compromise thousands of targets simultaneously. In December 2020, the cybersecurity firm FireEye and the United States government disclosed a massive intrusion originating from the software company SolarWinds. Russian intelligence operatives breached the build environment of SolarWinds and inserted a backdoor into the Orion network monitoring software. When SolarWinds distributed legitimate software updates to its customers, the malware, dubbed SUNBURST, was deployed to approximately 18,000 organizations. The SolarWinds supply chain compromise^[10] allowed the attackers to infiltrate multiple federal agencies, including the Departments of Treasury, Commerce, and Homeland Security, remaining undetected for months.

The integration of artificial intelligence into malware development represents the next frontier in this ongoing arms race. Threat actors are utilizing large language models to draft highly convincing phishing emails, write malicious scripts, and identify vulnerabilities in source code. Conversely, defenders are deploying machine learning algorithms to detect anomalous network behavior and identify zero day threats before they can execute.

From the theoretical cellular automata of John von Neumann to the sophisticated supply chain compromises of modern intelligence agencies, the history of malware is a reflection of technological dependence. As computing infrastructure becomes increasingly embedded in physical systems and daily life, the software designed to exploit it will continue to adapt, ensuring that the arms race between attackers and defenders remains a permanent fixture of the digital age.