View source for Timeline of computer viruses and worms

{{Short description|Computer malware timeline}}
{{distinguish|List of computer worms}}
{{cleanup|reason=includes many viruses of unclear noteworthiness|date=November 2015}}
[[File:Virus Blaster.jpg|thumb|[[Hex dump]] of the [[Blaster (computer worm)|Blaster worm]], showing a message left for [[Microsoft]] co-founder [[Bill Gates]] by the worm's programmer]]
This '''timeline of computer viruses and worms''' presents a chronological timeline of noteworthy [[computer virus]]es, [[computer worm]]s, [[Trojan horse (computing)|Trojan horses]], similar [[malware]], related research and events.

{{TOC limit|2}}

== 1960s ==
* [[John von Neumann]]'s article on the "Theory of self-reproducing automata" is published in 1966.<ref>{{cite book |last=von Neumann |first=John |author-link=John von Neumann |editor=Arthur W. Burks |title=Theory of self-reproducing automata |year=1966 |url=http://cba.mit.edu/events/03.11.ASE/docs/VonNeumann.pdf |publisher=University of Illinois Press |access-date=June 12, 2010 }}</ref> The article is based on lectures given by von Neumann at the [[University of Illinois]] about the "Theory and Organization of Complicated Automata" in 1949.

== 1970s ==

=== 1970 ===
* The first story written about a computer virus, ''The Scarred Man'' by [[Gregory Benford]], was published in the May 1970 issue of ''[[Venture Science Fiction]]''.<ref>{{Cite web |last=Benford |first=Gregory |website=Gregory Benford |title=The Scarred Man Returns |url=http://www.gregorybenford.com/extra/the-scarred-man-returns/ |access-date=2021-09-12 |language=en |archive-url=https://web.archive.org/web/20220930021524/http://www.gregorybenford.com/extra/the-scarred-man-returns/ |archive-date=2022-09-30 }}</ref>

=== 1971 ===
* The [[Creeper (program)|Creeper system]], an experimental self-replicating program, is written by Bob Thomas at [[BBN Technologies]] to test John von Neumann's theory.<ref>{{cite web|url = http://vx.netlux.org/lib/atc01.html|title = The Evolution of Viruses and Worms|first1 = Thomas|last1 = Chen|first2 = Jean-Marc|last2 = Robert|year = 2004|access-date = 2009-02-16|url-status = dead|archive-url = https://web.archive.org/web/20090517083356/http://vx.netlux.org/lib/atc01.html|archive-date = 2009-05-17}}</ref> Creeper infected DEC [[PDP-10]] computers running the [[TENEX (operating system)|TENEX operating system]]. Creeper gained access via the [[ARPANET]] and copied itself to the remote system where the message "I'm the creeper : catch me if you can!" was displayed. The [[Reaper (program)|Reaper]] program was later created to delete Creeper.<ref>{{Cite book|url = https://archive.org/details/computersecurity00russ|url-access = registration|page = [https://archive.org/details/computersecurity00russ/page/86 86]|title = Computer Security Basics|first1 = Deborah|last1 = Russell|first2 = G T|last2 = Gangemi|publisher = O'Reilly|year = 1991|isbn = 0-937175-71-4}}</ref>
* At the [[University of Illinois Urbana-Champaign|University of Illinois at Urbana-Champaign]], a graduate student named [[Alan M. Davis|Alan Davis]] (working for [[Donald B. Gillies|Prof. Donald Gillies]]) created a process on a [[PDP-11]] that (a) checked to see if an identical copy of itself was currently running as an active process, and if not, created a copy of itself and started it running; (b) checked to see if any disk space (which all users shared) was available, and if so, created a file the size of that space; and (c) looped back to step (a). As a result, the process stole all available disk space. When users tried to save files, the operating system advised them that the disk was full and that they needed to delete some existing files. Of course, if they did delete a file, this process would immediately snatch up the available space. When users called in a system administrator to fix the problem, he examined the active processes, discovered the offending process, and deleted it. Of course, before he left the room, the still existing process would create another copy of itself, and the problem would not go away. The only way to make the computer work again was to reboot.<ref>{{cite journal|title=First Virus?|journal=IEEE Software|first1=Alan M. |last1=Davis|volume=23|issue=4|date=July–August 2006|pages=8–10|doi=10.1109/MS.2006.101 |bibcode=2006ISoft..23d...8D }}</ref>

=== 1972 ===
* The science fiction novel, ''[[When HARLIE Was One]]'', by [[David Gerrold]], contains one of the first fictional representations of a [[computer virus]], as well as one of the first uses of the word "virus" to denote a program that infects a computer.<ref>{{cite web |url=http://www.kernelthread.com/publications/security/viruses.html |title=A Taste of Computer Security |date= |accessdate=2010-11-04 | archive-url=https://web.archive.org/web/20110927101813/http://www.kernelthread.com/publications/security/viruses.html |archive-date=2011-09-27 |url-status=dead}}</ref><ref>{{cite web |last1=Spafford |first1=Eugene H. |title=The Internet Worm Incident / Technical Report CSD-TR-933 |url=https://spaf.cerias.purdue.edu/tech-reps/933.pdf |access-date=19 December 2024 |page=3 |date=1991-09-19}}</ref>

=== 1973 ===
* In fiction, the 1973 [[Michael Crichton]] movie ''[[Westworld (film)|Westworld]]'' made an early mention of the concept of a computer virus, being a central plot theme that causes androids to run amok.<ref>{{cite web|url=https://www.imdb.com/title/tt0070909/synopsis|title= IMDB synopsis of Westworld|access-date=November 28, 2015|website=www.imdb.com}}</ref> [[Alan Oppenheimer]]'s character summarizes the problem by stating that {{nowrap|"[...] there's}} a clear pattern here which suggests an analogy to an infectious disease process, spreading from one{{nbs}}[...] area to the next." To which the replies are stated: "Perhaps there are superficial similarities to disease" and, "I must confess I find it difficult to believe in a disease of machinery."<ref>{{cite AV media |people=Michael Crichton |date=November 21, 1973 |title=Westworld |medium=movie|time=32 minutes |location=201 S. Kinney Road, Tucson, Arizona, USA |publisher=Metro-Goldwyn-Mayer |quote="And there's a clear pattern here which suggests an analogy to an infectious disease process, spreading from one resort area to the next." ... "Perhaps there are superficial similarities to disease." "I must confess I find it difficult to believe in a disease of machinery."}}</ref>{{notetag|Crichton's earlier work, the 1969 novel ''[[The Andromeda Strain]]'' and [[The Andromeda Strain (film)|1971 film]] were about an extraterrestrial biological virus-like disease that threatened the human race.}}

=== 1974 ===
* The [[Rabbit program|Rabbit]] (or Wabbit) virus, more a [[fork bomb]] than a virus, is written. The Rabbit virus makes multiple copies of itself on a single computer (and was named "[[rabbit]]" for the speed at which it did so) until it clogs the system, reducing system performance, before finally reaching a threshold and crashing the computer.<ref>[http://infocarnivore.com/the-very-first-viruses-creeper-wabbit-and-brain/ "The very first viruses: Creeper, Wabbit and Brain"], Daniel Snyder, InfoCarnivore, May 30, 2010, </ref>

=== 1975 ===
* April: ANIMAL is written by [[John Walker (programmer)|John Walker]] for the [[UNIVAC 1100/2200 series|UNIVAC 1108]].<ref name="http://www.fourmilab.ch/documents/univac/animalsrc.html">{{cite web|url=http://www.fourmilab.ch/documents/univac/animalsrc.html |title=ANIMAL Source Code |publisher=Fourmilab.ch |date=1996-08-13 |access-date=2012-03-29}}</ref> ANIMAL asked several questions of the user in an attempt to guess the type of animal the user was thinking of, while the related program PERVADE would create a copy of itself and ANIMAL in every directory to which the current user had access. It spread across the multi-user UNIVACs when users with overlapping permissions discovered the game, and to other computers when tapes were shared. The program was carefully written to avoid damaging existing file or directory structures, and to avoid copying itself if permissions did not exist or if harm would result. Its spread was halted by an OS upgrade that changed the format of the file status tables PERVADE used. Though non-malicious, "Pervading Animal" represents the first [[Trojan horse (computing)|Trojan]] "in the wild".<ref name="http://www.fourmilab.ch/documents/univac/animal.html">{{cite web|url=http://www.fourmilab.ch/documents/univac/animal.html |title=The Animal Episode |publisher=Fourmilab.ch |access-date=2012-03-29}}</ref>
* The novel ''[[The Shockwave Rider]]'' by [[John Brunner (novelist)|John Brunner]] is published, coining the word "[[Computer worm|worm]]" to describe a program that propagates itself through a [[computer network]].<ref name=ClassicSci-FiReviews>{{cite web |url=http://www.scifi.com/sfw/issue48/classic.html |work=Classic Sci-Fi Reviews |title=The Shockwave Rider |author=Craig E. Engler |year=1997 |access-date=2008-07-28 |archive-url = https://web.archive.org/web/20080703121956/http://www.scifi.com/sfw/issue48/classic.html <!-- Bot retrieved archive --> |archive-date = 2008-07-03}}</ref>

=== 1977 ===
*''[[The Adolescence of P-1]]'' novel,<ref>{{cite book |last=Ryan |first=Thomas J. |title=The Adolescence of P-1 |location=New York |publisher=Macmillan |year=1977 |edition=1st |isbn=0-02-606500-2}} </ref> describes a worm program that propagates through modem-based networks, eventually developing its own strategy-developing AI, which deals with cross-hardware and cross-os issues, eventually infecting hardware manufactures and defense organizations.

== 1980s ==

=== 1982 ===
* A program called [[Elk Cloner]], written for [[Apple II]] systems, was created by [[Mt. Lebanon High School]] student [[Rich Skrenta|Richard Skrenta]], originally as a prank. The Apple II was particularly vulnerable due to the need for a [[floppy disk]] to be present in order to bootstrap the computer. Elk Cloner's design combined with the public's general lack of knowledge regarding [[malware]] and how to protect against it led to Elk Cloner being responsible for the first computer virus outbreak in history.<ref>{{cite web|url=https://www.smh.com.au/articles/2007/09/01/1188671795625.html?page=fullpage#contentSwap2|title=First virus hatched as a practical joke|website=[[The Sydney Morning Herald]] (AP)|date=3 September 2007|access-date=9 September 2013}}</ref><ref>{{cite arXiv |last1=Levy |first1=Scott |last2=Crandall |first2=Jedidiah R. |title=The Program with a Personality: Analysis of Elk Cloner, the First Personal Computer Virus |date=30 July 2020 |class=cs.CR |eprint=2007.15759 }}</ref>

=== 1983 ===
* November: The term "virus" is re-coined by [[Fred Cohen|Frederick B. Cohen]] in describing self-replicating computer programs. In 1984 Cohen uses the phrase "computer virus" (suggested by his teacher [[Leonard Adleman]]) to describe the operation of such programs in terms of "infection". He defines a "virus" as "a program that can 'infect' other programs by modifying them to include a possibly evolved copy of itself." Cohen demonstrates a virus-like program on a [[VAX|VAX11/750]] system at [[Lehigh University]]. The program could install itself in, or infect, other system objects.<ref>{{cite web|url=http://www.eecs.umich.edu/%7Eaprakash/eecs588/handouts/cohen-viruses.html |author=Fred Cohen|title=Computer Viruses – Theory and Experiments |publisher=eecs.umich.edu |date=1983-11-03 |access-date=2012-03-29}}</ref>{{failed verification|date=December 2013}}

=== 1984 ===
* August: [[Ken Thompson]] publishes his seminal paper, "[[Reflections on Trusting Trust]]", in which he describes how he modified a [[C (programming language)|C]] [[compiler]] so that when used to compile a specific version of the [[Unix]] operating system, it inserts a [[backdoor (computing)|backdoor]] into the [[login]] command, and when used to compile a new copy of itself, it inserts the backdoor insertion code, even if neither the backdoor nor the backdoor insertion code is present in the [[source code]] of this new copy.<ref>{{cite journal|title=Reflections on Trusting Trust|journal=Communications of the ACM|volume=27|issue=8|date=August 1984|pages=761–763|doi=10.1145/358198.358210|s2cid=34854438|last1=Thompson|first1=Ken|doi-access=free}}</ref>

=== 1986 ===
* January: The [[Brain (computer virus)|Brain]] [[boot sector]] virus is released. Brain is considered the first [[IBM PC compatible]] virus, and the program responsible for the first IBM PC compatible virus epidemic. The virus is also known as Lahore, Pakistani, Pakistani Brain, and Pakistani flu as it was created in [[Lahore]], Pakistan, by 19-year-old Pakistani programmer Basit Farooq Alvi and his brother, Amjad Farooq Alvi.<ref name="theregisterJanuary2006">{{cite web|url=https://www.theregister.co.uk/2006/01/19/pc_virus_at_20/|title=PC virus celebrates 20th birthday|last=Leyden|first=John|date=January 19, 2006|work=[[The Register]]|access-date=March 21, 2011}}</ref>
* December: Ralf Burger presented the [[Virdem]] model of programs at a meeting of the underground [[Chaos Computer Club]] in Germany. The [[Virdem]] model represented the first programs that could replicate themselves via addition of their code to executable DOS files in COM format.<ref name=TAOCVRAD-Szor>{{cite book|url=https://books.google.com/books?id=XE-ddYF6uhYC&pg=PT204|title=The Art of Computer Virus Research and Defense|first1=Peter|last1=Szor|publisher=[[Symantec Press]] / [[Addison-Wesley]] Professional|date=2005|isbn=978-0-321-30454-4}}</ref>

=== 1987 ===
* Appearance of the Vienna virus, which was subsequently neutralized – the first time this had happened on the [[IBM]] platform.<ref name=wentworth>{{cite web|url=http://uanr.com/articles/virus.html|title=Computer Virus!|first1=Rob|last1=Wentworth|type=reprinted from ''The Digital Viking''|publisher=Twin Cities PC User Group|date=July 1996|access-date=9 September 2013|archive-url=https://web.archive.org/web/20131224165244/http://uanr.com/articles/virus.html|archive-date=24 December 2013|url-status=dead}}</ref>
* Appearance of Lehigh virus (discovered at its [[Lehigh University|namesake university]]),<ref name="wentworth"/> boot sector viruses such as Yale from the US, [[Stoned (computer virus)|Stoned]] from New Zealand, [[Ping-Pong virus|Ping Pong]] from Italy, and appearance of the first self-encrypting file virus, [[Cascade (computer virus)|Cascade]]. Lehigh was stopped on campus before it spread to the "wild" (to computers beyond the university), and as a result, has never been found elsewhere. A subsequent infection of Cascade in the offices of IBM Belgium led to IBM responding with its own antivirus product development. Prior to this, antivirus solutions developed at IBM were intended for staff use only.
* October: The [[Jerusalem (computer virus)|Jerusalem virus]], part of the (at that time unknown) Suriv family, is detected in the city of [[Jerusalem]]. The virus destroys all executable files on infected machines upon every occurrence of Friday the 13th (except Friday 13 November 1987 making its first trigger date May 13, 1988). Jerusalem caused a worldwide epidemic in 1988.<ref name=wentworth/>
* November: The [[SCA (computer virus)|SCA virus]], a boot sector virus for [[Amiga]] computers, appears. It immediately creates a pandemic virus-writer storm. A short time later, [[Swiss Cracking Association|SCA]] releases another, considerably more destructive virus, the [[Byte Bandit]].
* December: [[Christmas Tree EXEC]] was the first widely disruptive replicating network program, which paralyzed several international computer networks in December 1987. It was written in [[Rexx]] on the [[VM (operating system)|VM/CMS]] operating system and originated in [[West Germany]]. It re-emerged in 1990.

=== 1988 ===
* March 1: The [[Ping-Pong virus]] (also called Boot, Bouncing Ball, Bouncing Dot, Italian, Italian-A or VeraCruz), an MS-DOS boot sector virus, is discovered at the [[University of Turin]] in Italy.
* June: The [[Festering Hate|CyberAIDS and Festering Hate]] [[Apple ProDOS]] viruses spreads from underground pirate BBS systems and starts infecting mainstream networks. Festering Hate was the last iteration of the CyberAIDS series extending back to 1985 and 1986. Unlike the few Apple viruses that had come before which were essentially annoying, but did no damage, the Festering Hate series of viruses was extremely destructive, spreading to all system files it could find on the host computer (hard drive, floppy, and system memory) and then destroying everything when it could no longer find any uninfected files.
* November 2: The [[Morris worm]], created by [[Robert Tappan Morris]], infects [[Digital Equipment Corporation|DEC]] [[VAX]] and [[Sun Microsystems|Sun]] machines running [[Berkeley Software Distribution|BSD UNIX]] that are connected to the [[Internet]], and becomes the first worm to spread extensively "in the wild", and one of the first well-known programs exploiting [[Buffer overflow|buffer overrun]] vulnerabilities.
* December: The [[Father Christmas (computer worm)|Father Christmas worm]] attacks [[Digital Equipment Corporation|DEC]] [[VAX]] machines running [[OpenVMS|VMS]] that are connected to the [[DECnet#The DECnet Internet|DECnet Internet]] (an international scientific research network using [[DECnet]] protocols), affecting [[NASA]] and other research centers. Its purpose was to deliver a Christmas greeting to all affected users.

=== 1989 ===
* October: [[Ghostball]], the first multipartite virus, is discovered by [[Friðrik Skúlason]]. It infects both executable .COM files and boot sectors on MS-DOS systems.
* December: Several thousand floppy disks containing the [[AIDS (Trojan horse)|AIDS Trojan]], the first known [[ransomware]], are mailed to subscribers of PC Business World magazine and a WHO AIDS conference mailing list. This DOS Trojan lies dormant for 90 boot cycles, then encrypts all filenames on the system, displaying a notice asking for $189 to be sent to a post office box in Panama in order to receive a decryption program.

== 1990s ==

=== 1990 ===
* Mark Washburn, working on an analysis of the Vienna and Cascade viruses with Ralf Burger, develops the first family of [[Polymorphic code|polymorphic viruses]], the Chameleon family. Chameleon series debuted with the release of [[1260 (computer virus)|1260]].<ref>{{cite web |url=http://www.viruslist.com/en/viruses/encyclopedia?virusid=2008 |archive-url=https://archive.today/20120919103524/http://www.viruslist.com/en/viruses/encyclopedia?virusid=2008 |url-status=dead |archive-date=2012-09-19 |title=Virus.DOS.Chameleon.1260 – Securelist |publisher=Viruslist.com |access-date=2010-07-10 }}</ref><ref>{{cite web |url=http://vil.nai.com/vil/content/v_98074.htm |title=V2PX |publisher=Vil.nai.com |access-date=2010-07-10 |url-status=dead |archive-url=https://web.archive.org/web/20090722030020/http://vil.nai.com/vil/content/v_98074.htm |archive-date=2009-07-22 }}</ref><ref>{{cite web |url=http://www.viruslist.com/en/viruses/encyclopedia?chapter=153311162 |title=What we detect – Securelist |publisher=Viruslist.com |access-date=2010-07-10 |url-status=dead |archive-url=https://web.archive.org/web/20090713092458/http://www.viruslist.com/en/viruses/encyclopedia?chapter=153311162 |archive-date=2009-07-13 }}</ref>
* June: The [[Form (computer virus)|Form]] computer virus is isolated in Switzerland. It would remain in the wild for almost 20 years and reappear afterward; during the 1990s it tended to be the most common virus in the wild with 20 to more than 50 percent of reported infections.

=== 1991 ===
* Mattel releases a toyline called "Computer Warriors," bringing computer viruses into mainstream media. The villain, Megahert, is a sentient computer virus.

=== 1992 ===
* March: The [[Michelangelo (computer virus)|Michelangelo virus]] was expected to create a digital apocalypse on March 6, with millions of computers having their information wiped, according to mass media hysteria surrounding the virus. Later assessments of the damage showed the aftermath to be minimal. [[John McAfee]] had been quoted by the media as saying that five million computers would be affected. He later said that pressed by the interviewer to come up with a number, he had estimated a range from five thousand to five million, but the media naturally went with just the higher number.
* October: [[Milton-Bradley]] releases ''[[Omega Virus]]'', a board game containing one of the first examples of a sentient computer virus in mainstream media.

=== 1993 ===
* "Leandro" or "Leandro & Kelly"<ref>[http://about-threats.trendmicro.com/us//archive/malware/LEANDRO "Leandro"], ''Threat Encyclopedia'', Trend Micro, 9 March 2000. Retrieved 9 September 2013.</ref> and "Freddy Krueger"<ref>[http://wiw.org/~meta/vsum/view.php?vir=529 "Freddy Virus"], Virus Information Summary List, December 1992. Retrieved 9 September 2013.</ref> spread quickly due to popularity of [[Bulletin board system|BBS]] and [[shareware]] distribution.

=== 1994 ===
* April: [[OneHalf (computer virus)|OneHalf]] is a DOS-based polymorphic computer virus.
* September: ''[[ReBoot]]'' first airs, containing another memorable fictional, sentient computer virus, Megabyte.

=== 1995 ===
* The first [[Macro virus]], called "Concept", is created. It attacked Microsoft Word documents.<ref>{{cite web|url=http://www.viruslist.com/en/glossary?glossid=189267795 |title=Glossary – Securelist |publisher=Viruslist.com |access-date=2010-07-10}}</ref>

=== 1996 ===
* "Ply"&nbsp;– DOS 16-bit based complicated polymorphic virus appeared with a built-in permutation engine.
* Boza, the first virus designed specifically for Windows 95 files arrives.<ref>{{Cite web |last=Greg Miller |date=1996-02-20 |title=TECHNOLOGY : 'Boza' Infection of Windows 95 a Boon for Makers of Antivirus Software |url=https://www.latimes.com/archives/la-xpm-1996-02-20-fi-38090-story.html |access-date=2025-07-11 |website=[[Los Angeles Times]]}}</ref>
* Laroux, the first Excel macro virus appears.
* [[Staog]], the first [[Linux]] virus attacks Linux machines

=== 1997 ===

* [[Esperanto (computer virus)|Esperanto]], the first cross-platform virus, appears.

=== 1998 ===
*June 2: The first version of the [[CIH (computer virus)|CIH virus]] appears. It is the first known virus able to erase flash ROM BIOS content.

=== 1999 ===
* January 20: The [[Happy99]] worm first appeared. It invisibly attaches itself to emails, displays fireworks to hide the changes being made, and wishes the user a happy [[New Year]]. It modifies system files related to [[Outlook Express]] and [[Internet Explorer]] (IE) on [[Windows 95]] and [[Windows 98]].
* February : The [[Sub7]] is released targeting the Windows 9x and on the Windows NT family of operating systems.
* March 26: The [[Melissa (computer virus)|Melissa virus]] was released, targeting [[Microsoft Office Word|Microsoft Word]] and [[Microsoft Office Outlook|Outlook]]-based systems, and creating considerable network traffic.
* June 6: The [[ExploreZip]] worm, which destroys [[Microsoft Office]] documents, was first detected.
* September: the [[CTX (computer virus)|CTX]] virus is isolated
* December 30: The [[Kak worm]] is a [[JavaScript]] computer worm that spread itself by exploiting a bug in Outlook Express.<ref>{{cite web|url=http://www.symantec.com/security_response/writeup.jsp?docid=2000-121908-3951-99 |archive-url=https://web.archive.org/web/20060830014222/http://www.symantec.com/security_response/writeup.jsp?docid=2000-121908-3951-99 |url-status=dead |archive-date=August 30, 2006 |title=Wscript.KakWorm |publisher=Symantec |access-date=2012-03-29}}</ref>

== 2000s ==

===2000===
* May 5: The [[ILOVEYOU]] worm (also known as the Love Letter, VBS, or Love Bug worm), a computer worm written in VBScript and using [[Social engineering (security)|social engineering]] techniques, infected millions of Windows computers worldwide within a few hours of its release.
* June 28: The [[Pikachu virus]] is believed to be the first computer virus geared at children. It contains the character "[[Pikachu]]" from the [[Pokémon]] series. The operating systems affected by this worm are [[Windows 95]], [[Windows 98]], and Windows ME.
*The Y2K bug, or millennium bug, was the potential for computer systems to malfunction when the year changed from 1999 to 2000 because many programs used only two digits to represent the year. This caused fears that "00" would be interpreted as 1900, potentially causing chaos in critical systems like power grids and banks. Extensive, global remediation efforts costing billions were undertaken to fix the problem, and the transition passed smoothly.

=== 2001 ===
* February 11: The [[Anna Kournikova (computer virus)|Anna Kournikova virus]] hits e-mail servers hard by sending e-mail to contacts in the [[Microsoft Outlook]] addressbook.<ref>{{cite news| url=https://news.bbc.co.uk/2/hi/science/nature/1167453.stm | work=BBC News | title=Kournikova computer virus hits hard | date=February 13, 2001 | access-date=April 9, 2010}}</ref> Its creator, Jan de Wit, was sentenced to 150 hours of community service.<ref>{{cite web |url=http://www.computerworld.com/s/article/70752/Kournikova_virus_maker_appeals_sentence_ |title=Kournikova virus maker appeals sentence |first=Joris |last=Evers |date=May 3, 2002 |access-date=20 November 2010 |archive-date=5 June 2010 |archive-url=https://web.archive.org/web/20100605043845/http://www.computerworld.com/s/article/70752/Kournikova_virus_maker_appeals_sentence_ |url-status=dead }}</ref>
* March 13: Magistr, also called Disembowler, is discovered. It is a complex email worm for Windows systems with multiple payloads that trigger months apart from each other. It targets members of the Law profession by searching the files on a user's computer for various keywords relating to court proceedings, activating if such are found.<ref>{{cite web |url=http://virus.wikidot.com/magistr |website=The Virus Encyclopedia |access-date=21 October 2021|title=Magistr - the Virus Encyclopedia }}</ref>
* May 8: The [[Sadmind worm]] spreads by exploiting holes in both [[Sun Microsystems|Sun]] [[Solaris (operating system)|Solaris]] and [[Microsoft]] [[Internet Information Services|IIS]].
* July: The [[Sircam]] worm is released, spreading through Microsoft systems via e-mail and unprotected [[network share]]s.
* July 13: The [[Code Red (computer worm)|Code Red worm]] attacking the Index Server ISAPI Extension in Microsoft [[Internet Information Services]] is released.
* August 4: A complete re-write of the [[Code Red worm]], [[Code Red II]] begins aggressively spreading onto Microsoft systems, primarily in China.
* September 18: The [[Nimda]] worm is discovered and spreads through a variety of means including vulnerabilities in Microsoft Windows and backdoors left by [[Code Red II]] and [[Sadmind worm]].
* October 26: The [[Klez]] worm is first identified. It exploits a vulnerability in Microsoft Internet Explorer and Microsoft Outlook and Outlook Express.

=== 2002 ===
* February 11: The [[Simile (computer virus)|Simile virus]] is a [[Metamorphic code|metamorphic]] computer virus written in assembly.
* [[Beast (trojan horse)|Beast]] is a Windows-based backdoor Trojan horse, more commonly known as a RAT ([[remote administration tool|Remote Administration Tool]]). It is capable of infecting almost all versions of Windows. Written in [[Delphi (programming language)|Delphi]] and released first by its author Tataye in 2002, its most current version was released on October 3, 2004.
* March 7: [[Mylife (computer worm)|Mylife]] is a computer worm that spread itself by sending malicious emails to all the contacts in Microsoft Outlook.<ref>{{cite web |url=http://antivirus.about.com/library/weekly/aa030802a.htm |title=MyLife Worm |publisher=Antivirus.about.com |date=2002-03-07 |access-date=2012-03-29 |archive-date=2011-07-07 |archive-url=https://web.archive.org/web/20110707074844/http://antivirus.about.com/library/weekly/aa030802a.htm |url-status=dead }}</ref>

=== 2003 ===
* January 24: The [[SQL Slammer]] worm, aka ''Sapphire worm'', ''Helkern'' and other names, attacks vulnerabilities in [[Microsoft SQL Server]] and [[MSDE]] becomes the fastest spreading worm of all time (measured by doubling time at the peak rate of growth),<ref name="slammer">{{cite web|title=The Spread of the Sapphire/Slammer Worm|url=http://www.caida.org/publications/papers/2003/sapphire/sapphire.html|access-date=2012-12-14}}</ref> causing massive Internet access disruptions worldwide just fifteen minutes after infecting its first victim.<ref name="wired">{{cite magazine|url=https://www.wired.com/wired/archive/11.07/slammer.html|title=Slammed!|magazine=Wired|date=July 2003|access-date=2012-12-14}}</ref>
* April 2: [[Graybird]] is a trojan horse also known as Backdoor.Graybird.<ref name="symantec-graybird">{{cite web|url=http://securityresponse1.symantec.com/sarc/sarc.nsf/html/backdoor.graybird.html|title=Symantec Security Response: Backdoor.Graybird|last=Sevcenco|first=Serghei|date=February 10, 2006|publisher=Symantec|access-date=2009-03-01|url-status=dead|archive-url=https://archive.today/20031211194335/http://securityresponse1.symantec.com/sarc/sarc.nsf/html/backdoor.graybird.html|archive-date=December 11, 2003}}</ref>
* June 13: ProRat is a Turkish-made Microsoft Windows based backdoor trojan horse, more commonly known as a RAT (Remote Administration Tool).<ref name="prorat">{{cite web|url=http://www.symantec.com/security_response/writeup.jsp?docid=2003-061315-4216-99|archive-url=https://web.archive.org/web/20060901033711/http://www.symantec.com/security_response/writeup.jsp?docid=2003-061315-4216-99|url-status=dead|archive-date=September 1, 2006|title=Backdoor.Prorat|date=February 13, 2007|publisher=Symantec|access-date=2009-03-01}}</ref>
* August 12: The [[Blaster (computer worm)|Blaster worm]], aka the ''Lovesan'' worm, rapidly spreads by exploiting a vulnerability in system services present on Windows computers.
* August 18: The [[Welchia]] (Nachi) worm is discovered. The worm tries to remove the [[Blaster (computer worm)|Blaster worm]] and patch Windows.
* August 19: The [[Sobig]] worm (technically the [[Sobig{{Not a typo|.}}F worm]]) spreads rapidly through Microsoft systems via mail and network shares.
* September 18: [[Swen (computer worm)|Swen]] is a computer worm written in [[C++]].<ref>{{cite web|url=http://www.f-secure.com/v-descs/swen.shtml |title=Threat Description: Worm:W32/Swen |publisher=F-secure.com |access-date=2012-03-29}}</ref>
* October 24: The [[Sober worm]] is first seen on Microsoft systems and maintains its presence until 2005 with many new variants. The simultaneous attacks on network weak points by the Blaster and Sobig worms cause massive damage.
* November 10: [[Agobot]] is a computer worm that can spread itself by exploiting vulnerabilities on Microsoft Windows. Some of the vulnerabilities are MS03-026 and MS05-039.<ref>{{cite web |url=http://www.securelist.com/en/descriptions/old61021 |title=Backdoor.Win32.Agobot.gen |publisher=Securelist |access-date=2012-03-29 |url-status=dead |archive-url=https://web.archive.org/web/20120315225141/http://www.securelist.com/en/descriptions/old61021 |archive-date=2012-03-15 }}</ref>
* November 20: Bolgimo is a computer worm that spread itself by exploiting a buffer overflow vulnerability at Microsoft Windows DCOM RPC Interface (CVE-2003-0352).<ref>{{cite web|url=http://www.symantec.com/security_response/writeup.jsp?docid=2003-112019-2425-99 |archive-url=https://web.archive.org/web/20070107102105/http://www.symantec.com/security_response/writeup.jsp?docid=2003-112019-2425-99 |url-status=dead |archive-date=January 7, 2007 |title=W32.Bolgi{{Not a typo|.}}Worm |publisher=Symantec |access-date=2012-03-29}}</ref>

=== 2004 ===
* January 18: [[Bagle (computer worm)|Bagle]] is a mass-mailing worm affecting all versions of Microsoft Windows. There were two variants of Bagle worm, Bagle{{Not a typo|.}}A and Bagle.B. Bagle{{Not a typo|.}}B was discovered on February 17, 2004.
*January 26: The [[MyDoom]] worm emerges, and currently holds the record for the fastest-spreading mass mailer worm. The worm was most notable for performing a [[distributed denial-of-service]] (DDoS) attack on www.sco.com, which belonged to [[The SCO Group]].
* February 16: The [[Netsky (computer worm)|Netsky]] worm is discovered. The worm spreads by email and by copying itself to folders on the local hard drive as well as on mapped network drives if available. Many variants of the Netsky worm appeared.
* March 19: The [[Witty worm]] is a record-breaking worm in many regards. It exploited holes in several [[Internet Security Systems]] (ISS) products. It spread rapidly using a pre-populated list of ground-zero hosts.
* May 1: The [[Sasser worm]] emerges by exploiting a vulnerability in the Microsoft Windows [[Local Security Authority Subsystem Service|LSASS]] service and causes problems in networks, while removing [[MyDoom]] and [[Bagle (computer worm)|Bagle]] variants, even interrupting business.
* June 15: [[Caribe (computer worm)|Caribe]] or Cabir is a computer worm that is designed to infect mobile phones that run [[Symbian OS]]. It is the first computer worm that can infect mobile phones. It spread itself through [[Bluetooth]].<ref>{{cite web|url=http://www.f-secure.com/v-descs/cabir.shtml |title=Threat Description:Bluetooth-Worm:SymbOS/Cabir |publisher=F-secure.com |access-date=2012-03-29}}</ref><ref>{{cite web|url=http://www.symantec.com/security_response/writeup.jsp?docid=2004-061419-4412-99 |archive-url=https://web.archive.org/web/20070102072310/http://www.symantec.com/security_response/writeup.jsp?docid=2004-061419-4412-99 |url-status=dead |archive-date=January 2, 2007 |title=SymbOS.Cabir |publisher=Symantec |access-date=2012-03-29}}</ref>
* August 16: Nuclear RAT (short for Nuclear Remote Administration Tool) is a backdoor [[Trojan horse (computing)|trojan]] that infects [[Windows NT]] family systems ([[Windows 2000]], [[Windows XP]], [[Windows 2003]]).<ref name="nuclear-rat">{{cite web|url=http://www.ca.com/securityadvisor/pest/pest.aspx?id=453078396|title=Spyware Detail Nuclear RAT 1.0b1|date=August 16, 2004|publisher=Computer Associates|access-date=2009-03-01|archive-url=https://web.archive.org/web/20090911091523/http://www.ca.com/securityadvisor/pest/pest.aspx?id=453078396|archive-date=2009-09-11}}</ref>
* August 20: [[Vundo]], or the Vundo Trojan (also known as Virtumonde or Virtumondo and sometimes referred to as MS Juan) is a trojan known to cause popups and advertising for rogue antispyware programs, and sporadically other misbehavior including performance degradation and denial of service with some websites including [[Google]] and [[Facebook]].<ref name="vundo">{{cite web|url=http://vil.nai.com/vil/content/v_127690.htm|title=Vundo|publisher=McAfee|access-date=2009-03-01|url-status=dead|archive-url=https://web.archive.org/web/20090217105948/http://vil.nai.com/vil/content/v_127690.htm|archive-date=2009-02-17}}</ref>
* October 12: [[Bifrost (trojan horse)|Bifrost]], also known as Bifrose, is a backdoor trojan which can infect [[Windows 95]] through [[Windows Vista|Vista]]. Bifrost uses the typical server, server builder, and client backdoor program configuration to allow a remote attack.<ref name="bifrost">{{cite web|url=http://www.symantec.com/security_response/writeup.jsp?docid=2004-101214-5358-99|archive-url=https://web.archive.org/web/20070107192050/http://www.symantec.com/security_response/writeup.jsp?docid=2004-101214-5358-99|url-status=dead|archive-date=January 7, 2007|title=Backdoor.Bifrose|date=October 12, 2004|publisher=Symantec, Inc.|access-date=2009-02-28}}</ref>
* October 24: Potentially the first Mac OS X malware, Opener/Renepo trojan discovered.<ref>{{cite news |last=Cohen |first=Peter |title=SH/Renepo-A 'Opener' malware targets Mac OS X |url=https://www.macworld.com/article/172972/opener.html |work=Macworld |date=2004-10-24 |access-date=2025-10-14}}</ref> Depending on definitions, it may have been preceded by [[MP3Concept]] in April of that year.<ref>{{cite magazine |last=Kahney |first=Leander |title=OS X Trojan Horse Is a Nag |url=https://www.wired.com/2004/04/os-x-trojan-horse-is-a-nag/ |magazine=Wired |date=2004-04-09 |access-date=2025-10-14}}</ref>
* December: [[Santy]], the first known "webworm" is launched. It exploited a vulnerability in [[phpBB]] and used [[Google]] to find new targets. It infected around 40000 sites before Google filtered the search query used by the worm, preventing it from spreading.

=== 2005 ===
* August 2005: [[Zotob]] is a computer worm which exploits security vulnerabilities in Microsoft operating systems like Windows 2000, including the MS05-039 plug-and-play vulnerability (CVE-2005-1983). This worm has been known to spread on Microsoft-ds or TCP port 445.
* October 2005: The [[Sony BMG copy protection rootkit scandal|copy protection rootkit]] deliberately and surreptitiously included on music CDs sold by [[Sony BMG]] is exposed. The rootkit creates vulnerabilities on affected computers, making them susceptible to infection by worms and viruses.
* Late 2005: The [[Zlob trojan|Zlob Trojan]], is a Trojan horse program that masquerades as a required video codec in the form of the Microsoft Windows ActiveX component. It was first detected in late 2005.<ref name="zlob">{{cite web|url=http://www.trendmicro.com/vinfo/secadvisories/default6.asp?VNAME=The+ZLOB+Show%3A+Trojan+poses+as+fake+video+codec%2C+loads+more+threats|title=The ZLOB Show: Trojan Poses as Fake Video Codec, Loads More Threats |publisher=Trend Micro|access-date=2009-02-28}}</ref>

=== 2006 ===
* January 20: The [[Nyxem]] worm was discovered. It spread by mass-mailing. Its payload, which activates on the third of every month, starting on February 3, attempts to disable security-related and file-sharing software, and destroy files of certain types, such as Microsoft Office files.
* February 14: Discovery of the first-ever self-propagating malware for Mac OS X, a low-threat worm known as OSX/[[Leap virus|Leap]]-A or OSX/Oompa-A, is announced.
* Late March: [[Brontok]] variant N was found in late March.<ref>{{cite web|url=http://www.f-secure.com/v-descs/brontok_n.shtml |title=Threat Description: Email-Worm:W32/Brontok{{Not a typo|.}}N |publisher=F-secure.com |access-date=2012-03-29}}</ref> Brontok was a mass-email worm and the origin for the worm was from Indonesia.
* June: Starbucks is a virus that infects StarOffice and OpenOffice.
* Late September: [[Stration]] or Warezov worm first discovered.
* Development of [[Stuxnet]] is presumed to have been started between 2005 and 2006.

===2007===
* January 17: [[Storm Worm]] identified as a fast-spreading email spamming threat to Microsoft systems. It begins gathering infected computers into the [[Storm botnet]]. By around June 30, it had infected 1.7 million computers, and it had compromised between 1 and 10 million computers by September.<ref>{{cite web |title=World's most powerful supercomputer goes online |url=http://seclists.org/fulldisclosure/2007/Aug/0520.html |date=31 August 2007 |access-date=2007-11-04 |publisher=[[Full Disclosure (mailing list)|Full Disclosure]] |author=Peter Gutmann }}</ref> Thought to have originated from Russia, it disguises itself as a news email containing a film about bogus news stories asking the user to download the attachment which it claims is a film.
* July: [[Zeus (malware)|Zeus]] is a trojan that targets Microsoft Windows to steal banking information by keystroke logging.

=== 2008 ===
* February 17: [[Mocmex]] is a trojan, which was found in a digital photo frame in February 2008. It was the first serious computer virus on a digital photo frame. The virus was traced back to a group in China.<ref name="mocmex">{{cite news|url=http://www.seattlepi.com/business/351670_picframevirus18.html|title=Chinese PC virus may have hidden agenda|last=Gage|first=Deborah|newspaper=Seattle Post-Intelligencer |date=February 17, 2005|publisher=Seattle PI|access-date=2009-03-01}}</ref>
* March 3: [[Torpig]], also known as Sinowal and Mebroot, is a Trojan horse that affects Windows, turning off anti-virus applications. It allows others to access the computer, modifies data, steals confidential information (such as user passwords and other sensitive data) and installs more malware on the victim's computer.<ref name="torpig">{{cite web|url=http://www.f-secure.com/weblog/archives/00001393.html|title=MBR Rootkit, A New Breed of|last=Kimmo|date=March 3, 2008|publisher=F-Secure|access-date=2009-03-01}}</ref>
* May 6: Rustock.C, a hitherto-rumored spambot-type malware with advanced rootkit capabilities, was announced to have been detected on Microsoft systems and analyzed, having been in the wild and undetected since October 2007 at the very least.<ref name="prcom">{{cite web|url=http://www.pr.com/press-release/84130|title=Win32.Ntldrbot (aka Rustock)|publisher=Dr. Web Ltd.|access-date=2009-03-01}}</ref>
* July 6: Bohmini.A is a configurable remote access tool or trojan that exploits security flaws in Adobe Flash 9.0.115 with Internet Explorer 7.0 and Firefox 2.0 under Windows XP SP2.<ref name="virustotal-bohmini">{{cite web|url=http://www.virustotal.com/analisis/a5d8b3ba9226285dd14619fd8faf12a7|title=Virus Total|date=July 8, 2008|publisher=virustotal.com|access-date=2009-03-01|archive-url=https://web.archive.org/web/20090401173026/http://www.virustotal.com/analisis/a5d8b3ba9226285dd14619fd8faf12a7|archive-date=2009-04-01}}</ref>
* July 31: The [[Koobface]] computer worm targets users of [[Facebook]] and [[Myspace]]. New variants constantly appear.<ref name="CNet">{{cite web|url=http://news.cnet.com/8301-1009_3-20002112-83.html?|title=Koobface malware makes a comeback|date=April 9, 2010|publisher=cnet.com|access-date=2009-04-13}}</ref>
* November 21: Computer worm [[Conficker]] infected anywhere from 9 to 15 million Microsoft server systems running everything from [[Windows 2000]] to the [[Windows 7]] Beta. The French Navy,<ref>{{cite news|title = French fighter planes grounded by computer virus|first = Kim|last = Willsher|url = http://telegraph.co.uk/news/worldnews/europe/france/4547649/French-fighter-planes-grounded-by-computer-virus.html|newspaper = The Daily Telegraph|date = 2009-02-07|access-date = 2009-04-01 | location=London}}</ref> [[Ministry of Defence (United Kingdom)|UK Ministry of Defence]] (including Royal Navy warships and submarines),<ref>{{cite web|url = http://theregister.co.uk/2009/01/20/mod_malware_still_going_strong|title = MoD networks still malware-plagued after two weeks|first = Chris|last = Williams|date = 2009-01-20|website = The Register|access-date = 2009-01-20}}</ref> Sheffield Hospital network,<ref>{{cite web|url = http://theregister.co.uk/2009/01/20/sheffield_conficker|title = Conficker seizes city's hospital network|first = Chris|last = Williams|date = 2009-01-20|website = The Register|access-date = 2009-01-20}}</ref> German [[Bundeswehr]],<ref>{{Cite web|title = Conficker-Wurm infiziert hunderte Bundeswehr-Rechner|url = http://www.pc-professionell.de/news/2009/02/16/conficker_wurm_infiziert_hunderte_bundeswehr_rechner|date = 2009-02-16|access-date = 2009-04-01|publisher = PC Professionell|language = de|archive-url=https://web.archive.org/web/20090321171256/http://www.pc-professionell.de/news/2009/02/16/conficker_wurm_infiziert_hunderte_bundeswehr_rechner|archive-date=2009-03-21}}</ref> and Norwegian Police were all affected among many others. [[Microsoft]] set a bounty of US$250,000 for information leading to the capture of the worm's author(s).<ref>{{cite news|first = Barry|last = Neild|url = http://www.cnn.com/2009/TECH/ptech/02/13/virus.downadup/index.html|title = $250K Microsoft bounty to catch worm creator|publisher = CNN|date = 2009-02-13|access-date = 2009-03-29}}</ref> Five main variants of the worm are known and have been dubbed Conficker A, B, C, D and E, increasingly adding self-defense mechanisms. They were discovered 21 November 2008, 29 December 2008, 20 February 2009, 4 March 2009, and 7 April 2009, respectively. On December 16, 2008, Microsoft releases KB958644<ref>{{cite web|url = http://support.microsoft.com/kb/958644|title=MS08-067: Vulnerability in Server service could allow remote code execution|publisher=Microsoft Corporation}}</ref> patching the server service vulnerability (CVE-2008-4250) responsible for the spread of Conficker.

=== 2009 ===
* July 4: The [[July 2009 cyber attacks]] occur and the W32.Dozer attack on the [[United States]] and [[South Korea]] emerges.
* July 15: Symantec discovers [[Daprosy Worm]], a trojan worm intended to steal online game passwords in internet cafes by intercepting all keystrokes and sending them to its author.
* August 24: Source code for [[MiniPanzer and MegaPanzer|MegaPanzer]] is released by its author under GPLv3 and appears to have been detected in the wild.<ref>{{cite web|url=https://www.zdnet.com/article/source-code-for-skype-eavesdropping-trojan-in-the-wild/|title=Source code for Skype eavesdropping trojan in the wild|author=Dancho Danchev|work=ZDNet}}</ref><ref>{{cite magazine|url=https://www.wired.com/2009/08/skype-trojan/|title=Code for Skype Spyware Released to Thwart Surveillance|date=31 August 2009|magazine=WIRED}}</ref>
* November 27: The virus [[Kenzero]] is a virus that spreads online from [[peer-to-peer]] networks (P2P) taking browsing history.<ref>{{cite web |url=http://www.kait8.com/Global/story.asp?S=13220447 |title=Blackmail virus infects computers, holds information ransom |publisher=kait8.com |first=Josh |last=Harvison |date=September 27, 2010 |access-date=20 November 2010|archive-url=https://web.archive.org/web/20160611145434/http://www.kait8.com/Global/story.asp?S=13220447 |archive-date=2016-06-11 |url-status=dead}}</ref>

== 2010s ==

=== 2010 ===
*January: The [[Waledac botnet]] sent spam emails. In February 2010, an international group of security researchers and Microsoft took Waledac down.<ref>{{cite web |url=http://honeyblog.org/archives/52-Waledac-Takedown-Successful.html |title=Waledac Takedown Successful |publisher=honeyblog.org |date=February 25, 2010 |access-date=16 November 2012}}</ref>
*January: The [[Psyb0t]] worm is discovered. It is thought to be unique in that it can infect routers and high-speed modems.<ref>{{cite web|url= http://www.pcworld.com/article/161941/nasty_new_worm_targets_home_routers_cable_modems.html?tk=rss_main|title=Nasty New Worm Targets Home Routers, Cable Modems|last=Paul|first=Ian|date=25 March 2009|work=PC World|access-date=2009-03-26}}</ref>
* February 18: [[Microsoft]] announced that a [[Blue Screen of Death|BSoD]] problem on some Windows machines which was triggered by a batch of [[Patch Tuesday]] updates was caused by the [[Alureon]] Trojan.<ref>{{cite web|url=http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Win32%2fAlureon|title=Alureon trojan caused Windows 7 BSoD|date=February 18, 2010|publisher=microsoft.com|access-date=2010-02-18}}</ref>
* June 17: [[Stuxnet]], a Windows Trojan, was detected.<ref>{{cite web |url=http://anti-virus.by/en/tempo.shtml |title=VirusBlokAda News |publisher=Anti-virus.by |access-date=2012-03-29 |archive-date=2012-03-09 |archive-url=https://web.archive.org/web/20120309182144/http://www.anti-virus.by/en/tempo.shtml |url-status=dead }}</ref> It is the first worm to attack [[SCADA]] systems.<ref name="Keizer1">{{cite magazine|url=http://www.infoworld.com/print/137598|archive-url=https://archive.today/20121205012450/http://www.infoworld.com/print/137598|url-status=dead|archive-date=5 December 2012|magazine=[[InfoWorld]]|title=Is Stuxnet the 'best' malware ever?|date=16 September 2010|author=Gregg Keizer|access-date=16 September 2010}}</ref> There are suggestions that it was designed to target Iranian nuclear facilities.<ref>[https://www.telegraph.co.uk/technology/news/8021102/Stuxnet-virus-worm-could-be-aimed-at-high-profile-Iranian-targets.html Stuxnet virus: worm 'could be aimed at high-profile Iranian targets’], Telegraph, 23 Sep 2010</ref> It uses a valid certificate from [[Realtek]].<ref>{{cite web |url=http://threatpost.com/possible-new-rootkit-has-drivers-signed-realtek-071510 |title=Possible New Rootkit Has Drivers Signed by Realtek |date= 15 July 2010 |publisher=Kaspersky Labs}}</ref>
* September 9: The virus, called "[[here you have]]" or "VBMania", is a simple Trojan horse that arrives in the inbox with the odd-but-suggestive subject line "here you have". The body reads "This is The Document I told you about, you can find it Here" or "This is The Free Download Sex Movies, you can find it Here".

===2011===
* [[SpyEye]] and [[Zeus (Trojan horse)|Zeus]] merged code is seen.<ref>{{cite news |url= https://www.theregister.co.uk/2011/01/25/spyeye_zeus_merger/ |title=Bastard child of SpyEye/ZeuS merger appears online |work=The Register |year=2011 |quote=Bastard child of SpyEye/ZeuS merger appears online |access-date=April 11, 2011}}</ref> New variants attack [[Mobile banking|mobile phone banking]] information.<ref>{{cite web |url= https://www.theregister.co.uk/2011/04/05/spyeye_mobile_trojan/ |title=SpyEye mobile banking Trojan uses same tactics as ZeuS |work=The Register |year=2011 |quote=SpyEye mobile banking Trojan uses same tactics as ZeuS |access-date=April 11, 2011}}</ref>
* Anti-Spyware 2011, a Trojan horse that attacks Windows 9x, 2000, XP, Vista, and Windows 7, posing as an anti-spyware program. It disables security-related processes of anti-virus programs, while also blocking access to the Internet, which prevents updates.<ref>{{cite web|url=http://www.precisesecurity.com/rogue/xp-anti-spyware-2011/ |archive-url=https://web.archive.org/web/20110510074804/http://www.precisesecurity.com/rogue/xp-anti-spyware-2011/ |url-status=usurped |archive-date=May 10, 2011 |title=XP AntiSpyware 2011 – Virus Solution and Removal |publisher=Precisesecurity.com |access-date=2012-03-29}}</ref>
* Summer 2011: The Morto worm attempts to propagate itself to additional computers via the Microsoft Windows [[Remote Desktop Protocol]] (RDP). Morto spreads by forcing infected systems to scan for Windows servers allowing RDP login. Once Morto finds an RDP-accessible system, it attempts to log into a domain or local system account named 'Administrator' using several common passwords.<ref name="morto">{{cite web|url=http://blogs.appriver.com/blog/digital-degenerate-2/morto-worm-spreads-to-weak-systems|title=Morto Worm Spreads to Weak Systems|work=blogs.appriver.com|year=2011|access-date=2011-08-31|archive-url=https://web.archive.org/web/20111014022544/http://blogs.appriver.com/blog/digital-degenerate-2/morto-worm-spreads-to-weak-systems|archive-date=2011-10-14|url-status=dead}}</ref> A detailed overview of how the worm works – along with the password dictionary Morto uses – was done by [[Imperva]].<ref name="imperva">{{cite web |date=2011-09-07 |title=Morto Post Mortem: Dissecting a Worm |url=https://www.imperva.com/blog/archive/morto-post-mortem-a-worm-deep-dive/ |access-date=2024-07-05 |work=blog.imperva.com}}</ref>
* July 13: the [[ZeroAccess]] rootkit (also known as Sirefef or max++) was discovered.
* September 1: [[Duqu]] is a worm thought to be related to the [[Stuxnet]] worm. The Laboratory of Cryptography and System Security ([[CrySyS Lab]])<ref>{{cite web | url = http://www.crysys.hu/ | title = Laboratory of Cryptography and System Security (CrySyS) | access-date =4 November 2011}}</ref> of the [[Budapest University of Technology and Economics]] in [[Hungary]] discovered the threat, analysed the malware, and wrote a 60-page report naming the threat Duqu.<ref>{{cite web | url = http://www.crysys.hu/publications/files/bencsathPBF11duqu.pdf | title = Duqu: A Stuxnet-like malware found in the wild, technical report | publisher = Laboratory of Cryptography of Systems Security (CrySyS) | date = 14 October 2011}}</ref><ref>{{cite web | url = http://www.crysys.hu/in-the-press.html | title = Statement on Duqu's initial analysis | publisher = Laboratory of Cryptography of Systems Security (CrySyS) | date = 21 October 2011 | access-date = 25 October 2011 | url-status = dead | archive-url = https://web.archive.org/web/20121002235948/http://crysys.hu/in-the-press.html | archive-date = 2 October 2012 }}</ref> Duqu gets its name from the prefix "~DQ" it gives to the names of files it creates.<ref name=syamantecduqu>{{cite web |url = http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_duqu_the_precursor_to_the_next_stuxnet.pdf |archive-url = https://web.archive.org/web/20111213083345/http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_duqu_the_precursor_to_the_next_stuxnet.pdf |url-status = dead |archive-date = December 13, 2011 |title = W32.Duqu – The precursor to the next Stuxnet (Version 1.4) |publisher = [[NortonLifeLock|Symantec]] |date = 23 November 2011 |access-date =30 December 2011}}</ref>

===2012===
* May: [[Flame (malware)|Flame]] – also known as Flamer, sKyWIper, and Skywiper –  a modular computer malware that attacks computers running Microsoft Windows. Used for targeted [[cyber espionage]] in Middle Eastern countries. Its discovery was announced on 28 May 2012 by MAHER Center of Iranian National Computer Emergency Response Team (CERT), Kaspersky Lab and CrySyS Lab of the Budapest University of Technology and Economics. CrySyS stated in their report that "sKyWIper is certainly the most sophisticated malware we encountered during our practice; arguably, it is the most complex malware ever found".<ref name=":0">{{cite web |url=http://www.crysys.hu/skywiper/skywiper.pdf |title=sKyWIper: A Complex Malware for Targeted Attacks |date=28 May 2012 |publisher=[[Budapest University of Technology and Economics]] |access-date=29 May 2012 |archive-url=https://web.archive.org/web/20120528142705/http://www.crysys.hu/skywiper/skywiper.pdf |archive-date=28 May 2012 |url-status=dead |df=dmy-all }}</ref>
* August 16: [[Shamoon]] is a computer virus designed to target computers running Microsoft Windows in the energy sector. Symantec, Kaspersky Lab, and Seculert announced its discovery on August 16, 2012.
* September 20: NGRBot is a worm that uses the IRC network for file transfer, sending and receiving commands between zombie network machines and the attacker's IRC server, and monitoring and controlling network connectivity and intercept. It employs a user-mode rootkit technique to hide and steal its victim's information. This family of bot is also designed to infect HTML pages with inline frames ([[HTML element#Frames|iframes]]), causing redirections, blocking victims from getting updates from security/antimalware products, and killing those services. The bot is designed to connect via a predefined IRC channel and communicate with a remote botnet.<ref name=":1">[http://www.enigmasoftware.com/ngrbot-removal/ "NGRBot"], Enigma Software Group, 15 October 2012. Retrieved 9 September 2013.</ref><ref name=":2">[http://www.virusbtn.com/virusbulletin/archive/2012/01/vb201201-NGR-botnet "Dissecting the NGR bot framework: IRC botnets die hard"], Aditya K. Sood and Richard J. Enbody, Michigan State University, USA, and Rohit Bansal, SecNiche Security, USA, with Helen Martin1 (ed.), January 2012. Retrieved 9 September 2013. {{Subscription required}}</ref>

===2013===
* September: The [[CryptoLocker]] Trojan horse is discovered. CryptoLocker encrypts the files on a user's hard drive, then prompts them to pay a ransom to the developer to receive the decryption key. In the following months, several copycat ransomware Trojans were also discovered.
* December: The [[Gameover ZeuS]] Trojan is discovered. This type of virus steals one's login details on popular Web sites that involve monetary transactions. It works by detecting a login page, then proceeds to inject malicious code into the page, [[keystroke logging]] the computer user's details.
* December: [[Linux.Darlloz]] targets the [[Internet of things]] and infects [[router (computing)|router]]s, [[security camera]]s, [[set-top box]]es by exploiting a [[PHP]] vulnerability.<ref name=":3">{{cite web | url=https://arstechnica.com/security/2013/11/new-linux-worm-targets-routers-cameras-internet-of-things-devices/ | title=New Linux worm targets routers, cameras, "Internet of things" devices | website=[[Ars Technica]] | date=2013-11-27 | access-date=October 24, 2016 | author=Goodin, Dan}}</ref><ref name=":4">{{cite magazine | url=https://www.wired.com/2014/01/spime-watch-linux-darlloz-internet-things-worm/ | title=Linux.Darlloz, the Internet-of-Things worm | magazine=[[Wired (magazine)|Wired]] | date=2014-01-29 | access-date=24 October 2016 | author=Sterling, Bruce}}</ref>

===2014===
* November: The [[Regin (malware)|Regin]] Trojan horse is discovered. Regin is a [[Dropper (malware)|dropper]], primarily spread via spoofed Web pages. Once installed, it quietly downloads additional malware, making it difficult for signature-based anti-virus programs to detect. It is believed to have been created by the United States and United Kingdom as a tool for espionage and [[mass surveillance]].{{cn|date=August 2020}}

===2015===
* The [[BASHLITE]] malware is leaked leading to a massive spike in DDoS attacks.<ref name="Level3">{{cite web | url=http://blog.level3.com/security/attack-of-things/ | title=Attack of Things! | date=25 August 2016 | access-date=6 November 2016 | publisher=Level 3 Threat Research Labs | archive-date=3 October 2016 | archive-url=https://web.archive.org/web/20161003194500/http://blog.level3.com/security/attack-of-things/ | url-status=dead }}</ref>
* [[Linux.Wifatch]] is revealed to the general public. It is found to attempt to secure devices from other more malicious malware.<ref name="symantec1">{{Cite web |url=https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=ef23b297-5cc6-4c4a-b2e7-ff41635965fe&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments |title=Is there an Internet-of-Things vigilante out there? |last=Ballano, Mario |date=1 Oct 2015 |publisher=[[NortonLifeLock|Symantec]] |access-date=14 November 2016}}</ref><ref name=":5">{{cite web | url=https://gitlab.com/rav7teif/linux.wifatch | title=linux.wifatch | publisher=The White Team | date=October 5, 2015 | access-date=15 November 2016}}</ref><ref name=":6">{{cite web | url=http://news.softpedia.com/news/creators-of-the-benevolent-linux-wifatch-malware-reveal-themselves-493938.shtml | title=Creators of the Benevolent Linux.Wifatch Malware Reveal Themselves | publisher=[[Softpedia]] | date=Oct 7, 2015 | access-date=14 November 2016 | author=Cimpanu, Catalin}}</ref>

===2016===
* January: A trojan named "[[MEMZ trojan|MEMZ]]" is created. The creator, Leurak, explained that the trojan was intended merely as a joke.<ref name="memz_1">{{cite magazine|url=https://www.vice.com/en/article/watch-this-malware-turn-a-computer-into-a-digital-hellscape/|title=Watch This Malware Turn a Computer into a Digital Hellscape|last=Oberhaus|first=Daniel|date=July 9, 2016|magazine=[[Vice (magazine)|Motherboard]]|access-date=July 4, 2018}}</ref> The trojan alerts the user to the fact that it is a trojan and warns them that if they proceed, the computer may no longer be usable. It contains complex payloads that corrupt the system, displaying [[Visual artifact|artifacts]] on the screen as it runs. Once run, the application cannot be closed without causing further damage to the computer, which will stop functioning properly regardless. When the computer is restarted, in place of the [[bootsplash]] is a message that reads "Your computer has been trashed by the MEMZ Trojan. Now enjoy the Nyan cat...", which follows with an animation of the [[Nyan Cat]].<ref name="memz_2">{{cite web|url=https://windowsreport.com/memz-virus-windows-pc/|title=MEMZ virus: what is it and how it affects Windows PC?|last=Dean|first=Madeleine|date=August 26, 2016|publisher=Windows Report|access-date=July 4, 2018}}</ref>
* February: Ransomware [[Locky]] with its over 60 derivatives spread throughout Europe and infected several million computers. At the height of the spread over five thousand computers per hour were infected in Germany alone.<ref name=":7">[https://www.bsi-fuer-buerger.de/BSIFB/DE/Service/Aktuell/Informationen/Artikel/Ransomware.html "Ransomware: Erpresserische Schadprogramme"] {{Webarchive|url=https://web.archive.org/web/20160221102402/https://www.bsi-fuer-buerger.de/BSIFB/DE/Service/Aktuell/Informationen/Artikel/Ransomware.html |date=2016-02-21 }}, bsi-fuer-buerger.de, 9 February 2016. Retrieved 10 March 2016.</ref> Although [[ransomware]] was not a new thing at the time, insufficient cyber security as well as a lack of standards in IT was responsible for the high number of infections.<ref name=":8">[https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=5dcac8a2-6d48-4ebb-9060-f45e2fa5f465&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments "Locky ransomware on aggressive hunt for victims"], Symantec.com, 18 February 2016. Retrieved 10 March 2016.</ref> Unfortunately, even up to date antivirus and internet security software was unable to protect systems from early versions of Locky.<ref name=":9">[https://www.virustotal.com/en/file/5e945c1d27c9ad77a2b63ae10af46aee7d29a6a43605a9bfbf35cebbcff184d8/analysis/1455638481/ "Antivirus scan for (Locky)"], virustotal.com, 16 February 2016. Retrieved 10 March 2016.</ref>
* February: [[Tiny Banker Trojan]] (Tinba) makes headlines.<ref name=":10">{{cite web|url=https://www.massivealliance.com/2014/09/19/tiny-banker-malware-attempted-customers-us-banks/|title='Tiny Banker' Malware Attempted At Customers Of US Banks|last=danielevir|date=19 September 2014|website=Massive Alliance|access-date=10 September 2017}}</ref> Since its discovery, it has been found to have infected more than two dozen major banking institutions in the United States, including TD Bank, Chase, HSBC, Wells Fargo, PNC and Bank of America.<ref name=":11">{{cite web|url=https://www.entrust.com/modified-tiny-banker-trojan-found-targeting-major-u-s-banks/|title=Modified Tiny Banker Trojan Found Targeting Major U.S. Banks|work=Entrust, Inc.|access-date=2016-04-02|archive-date=2016-03-04|archive-url=https://web.archive.org/web/20160304162051/https://www.entrust.com/modified-tiny-banker-trojan-found-targeting-major-u-s-banks/|url-status=dead}}</ref><ref name=":12">{{cite web|url=http://www.pcworld.com/article/2684112/tiny-banker-malware-targets-us-financial-institutions.html|title='Tiny banker' malware targets US financial institutions|author=Jeremy Kirk|date=15 September 2014|work=PCWorld}}</ref> Tiny Banker Trojan uses HTTP injection to force the user's computer to believe that it is on the bank's website. This spoof page will look and function just as the real one. The user then enters their information to log on, at which point Tinba can launch the bank webpage's "incorrect login information" return, and redirect the user to the real website. This is to trick the user into thinking they had entered the wrong information and proceed as normal, although now Tinba has captured the credentials and sent them to its host.<ref name=":13">{{cite web|url=http://www.tripwire.com/state-of-security/latest-security-news/tiny-banker-malware-targets-dozens-of-major-us-financial-institutions/|title='Tiny Banker' Malware Targets Dozens of Major US Financial Institutions|work=The State of Security|date=2014-09-16}}</ref><ref name=":14">{{cite web|url=https://www.nbcnews.com/id/wbna47633142|title=Tiny 'Tinba' Banking Trojan Is Big Trouble|work=msnbc.com|date=2012-05-31}}</ref>
* August: Journalists and researchers report the discovery of [[spyware]], called [[Pegasus (spyware)|Pegasus]], developed and distributed by a private company which can and has been used to infect [[iOS]] and [[Android (operating system)|Android]] [[smartphone]]s often – based on [[Zero-day (computing)|0-day exploits]] – without the need for any user-interaction or significant clues to the user and [[Mobile security|then be used]] to exfiltrate data, track user locations, capture film through its camera, and activate the microphone at any time. [[Pegasus Project (investigation)|The investigation]] suggests it was used on many targets worldwide and revealed its use for e.g. governments' espionage on journalists, opposition politicians, activists, business people and others.<ref>{{cite news |title=What is Pegasus spyware and how does it hack phones? |url=https://www.theguardian.com/news/2021/jul/18/what-is-pegasus-spyware-and-how-does-it-hack-phones |access-date=13 August 2021 |work=The Guardian |date=18 July 2021 |language=en}}</ref>
* September: [[Mirai (malware)|Mirai]] creates headlines by launching some of the most powerful and disruptive DDoS attacks seen to date by infecting the [[Internet of Things]]. Mirai ends up being used in the DDoS attack on 20 September 2016 on the [[Krebs on Security]] site which reached 620&nbsp;Gbit/s.<ref name=":15">''[[The Economist]]'', 8 October 2016, [https://www.economist.com/news/science-and-technology/21708220-electronic-tsunami-crashes-down-solitary-journalist-internet The internet of stings]</ref> [[Ars Technica]] also reported a 1&nbsp;Tbit/s attack on French web host [[OVH]].<ref name=securityintelligence>{{cite web | url=https://securityintelligence.com/news/leaked-mirai-malware-boosts-iot-insecurity-threat-level/ | title=Leaked Mirai Malware Boosts IoT Insecurity Threat Level | publisher=securityintelligence.com | date=October 4, 2016 | access-date=20 October 2016 | author=Bonderud, Douglas}}</ref> On 21 October 2016 multiple major DDoS attacks in [[DNS]] services of DNS service provider [[Dyn (company)|Dyn]] occurred using Mirai malware installed on a large number of [[Internet of things|IoT devices]], resulting in the inaccessibility of several high-profile websites such as [[GitHub]], [[Twitter]], [[Reddit]], [[Netflix]], [[Airbnb]] and many others.<ref name=":16">{{cite web | url=https://www.theregister.co.uk/2016/10/21/dyn_dns_ddos_explained/ | title=Today the web was broken by countless hacked devices | publisher=theregister.co.uk | date=21 October 2016 | access-date=24 October 2016}}</ref> The attribution of the attack to the Mirai botnet was originally reported by BackConnect Inc., a security firm.<ref name=":17">{{cite web|title=Blame the Internet of Things for Destroying the Internet Today|url=https://www.vice.com/en/article/blame-the-internet-of-things-for-destroying-the-internet-today/|website=Motherboard|publisher=VICE|access-date=27 October 2016|date=2016-10-21}}</ref>

=== 2017 ===
* May: The [[WannaCry ransomware attack]] spreads globally. Exploits revealed in the [[NSA]] hacking toolkit leak of late 2016 were used to enable the propagation of the malware.<ref name=":18">{{Cite news|url=https://www.theguardian.com/technology/2017/may/12/global-cyber-attack-ransomware-nsa-uk-nhs|title=Massive ransomware cyber-attack hits 74 countries around the world|last1=Wong|first1=Julia Carrie|author-link=Julia Carrie Wong|date=2017-05-12|work=The Guardian|access-date=2017-05-12|last2=Solon|first2=Olivia|language=en-GB|issn=0261-3077}}</ref> Shortly after the news of the infections broke online, a UK cybersecurity researcher in collaboration with others found and activated a "kill switch" hidden within the ransomware, effectively halting the initial wave of its global propagation.<ref name=":19">{{Cite news|url=https://www.theguardian.com/technology/2017/may/13/accidental-hero-finds-kill-switch-to-stop-spread-of-ransomware-cyber-attack|title='Accidental hero' finds kill switch to stop spread of ransomware cyber-attack|last=Solon|first=Olivia|date=2017-05-13|work=The Guardian|access-date=2017-05-13|language=en-GB|issn=0261-3077}}</ref> The next day, researchers announced that they had found new variants of the malware without the kill switch.<ref name=":20">{{Cite news|url=http://thehackernews.com/2017/05/wannacry-ransomware-cyber-attack.html|title=It's Not Over, WannaCry 2.0 Ransomware Just Arrived With No 'Kill-Switch'|last=Khandelwal|first=Swati|work=The Hacker News|access-date=2017-05-14|language=en-US}}</ref>
*June: The [[Petya (malware family)|Petya]] attack spreads globally affecting Windows systems. Researchers at Symantec reveal that this ransomware uses the EternalBlue exploit, similar to the one used in the [[WannaCry ransomware attack]].<ref name=":21">{{cite web|url=https://www.symantec.com/connect/blogs/petya-ransomware-outbreak-here-s-what-you-need-know|archive-url=https://web.archive.org/web/20170629093754/https://www.symantec.com/connect/blogs/petya-ransomware-outbreak-here-s-what-you-need-know|url-status=dead|archive-date=June 29, 2017|title=Petya ransomware outbreak: Here's what you need to know|access-date=10 September 2017}}</ref><ref name=":22">{{cite web|url=https://www.symantec.com/security_response/writeup.jsp?docid=2016-032913-4222-99|archive-url=https://web.archive.org/web/20160902114244/https://www.symantec.com/security_response/writeup.jsp?docid=2016-032913-4222-99|url-status=dead|archive-date=September 2, 2016|title=Ransom.Petya - Symantec|website=[[Broadcom#Symantec enterprise security|Symantec]]|access-date=10 September 2017}}</ref><ref name=":23">{{cite web|url=https://krebsonsecurity.com/2017/06/petya-ransomware-outbreak-goes-global/|title='Petya' Ransomware Outbreak Goes Global — Krebs on Security|website=krebsonsecurity.com|date=28 June 2017 |access-date=10 September 2017}}</ref>
*September: The [[Xafecopy Trojan]] attacks 47 countries, affecting only Android operating systems. Kaspersky Lab identified it as a malware from the Ubsod family, stealing money through click based WAP billing systems.<ref name=":24">{{cite news|url=http://economictimes.indiatimes.com/tech/internet/new-malware-steals-users-money-through-mobile-phones-report/articleshow/60448837.cms|title=New malware steals users' money through mobile phones: Report|date=10 September 2017|access-date=10 September 2017|newspaper=The Economic Times}}</ref><ref name=":25">{{cite web|url=http://www.firstpost.com/tech/news-analysis/xafecopy-trojan-a-new-malware-detected-in-india-it-disguises-itself-as-an-app-to-steals-money-via-mobile-phones-4028709.html|title=Xafecopy Trojan, a new malware detected in India; it disguises itself as an app to steals money via mobile phones|website=Tech2|access-date=10 September 2017|date=2017-09-10}}</ref>
*September: A new variety of Remote Access Trojan (RAT), Kedi RAT, is distributed in a Spear Phishing Campaign. The attack targeted [[Citrix]] users. The Trojan was able to evade usual system scanners. Kedi Trojan had all the characteristics of a common [[Remote Access Trojan]] and it could communicate to its Command and Control center via Gmail using common HTML, HTTP protocols.<ref name=":26">{{Cite web|url=https://www.techscoop.in/2017/09/KediRAT-can-steal-your-information-and.html|title=Kedi RAT can steal your information and send it through gmail}}</ref><ref name=":27">{{Cite web|url=https://nakedsecurity.sophos.com/2017/09/12/beware-the-kedi-rat-pretending-to-be-a-citrix-file-that-gmails-home/|title=Beware the Kedi RAT pretending to be a Citrix file that Gmails home|date=2017-09-12|access-date=2017-09-13|archive-date=2017-09-13|archive-url=https://web.archive.org/web/20170913103535/https://nakedsecurity.sophos.com/2017/09/12/beware-the-kedi-rat-pretending-to-be-a-citrix-file-that-gmails-home/|url-status=dead}}</ref>

=== 2018 ===
*February: Thanatos, a ransomware, becomes the first ransomware program to accept ransom payment in [[Bitcoin Cash]].<ref name=":28">{{Cite web|url=https://www.bleepingcomputer.com/news/security/thanatos-ransomware-is-first-to-use-bitcoin-cash-messes-up-encryption/|title=Thanatos Ransomware Is First to Use Bitcoin Cash. Messes Up Encryption|last=Abrams|first=Lawrence|date=February 26, 2018|website=[[Bleeping Computer]]|access-date=June 25, 2019}}</ref>

===2019===
*November: [[Titanium (malware)|Titanium]] is an advanced [[Backdoor (computing)|backdoor]] [[malware]], developed by the [[PLATINUM (cybercrime group)|PLATINUM]] [[Advanced persistent threat|APT]].<ref name="KAS-20191108">{{cite news |last=AMR |first=GReAT |title=Titanium: the Platinum group strikes again |url=https://securelist.com/titanium-the-platinum-group-strikes-again/94961/ |date=8 November 2019 |work=[[Kaspersky Lab]] |access-date=9 November 2019 }}</ref>

== 2020s ==

=== 2024 ===
* March 2: Researchers Nassi, Cohen, and Bitton developed a computer worm called Morris II, targeting generative AI email assistants to steal data and send spam, thereby breaching security protections of systems like [[ChatGPT]] and [[Gemini (chatbot)|Gemini]]. Conducted in a test environment, this research highlights the security risks of multimodal large language models (LLMs) that now generate text, images, and videos. Generative AI systems, which operate on prompts, can be exploited through weaponized prompts. For instance, hidden text on a webpage could instruct an [[Large language model|LLM]] to perform malicious activities, such as phishing for bank details. While generative AI worms like Morris II haven’t been observed in the public, their potential threat is a concern for the tech industry.<ref>{{Cite web |last=WIRED |date=2024-03-02 |title=Researchers create AI worms that can spread from one system to another |url=https://arstechnica.com/ai/2024/03/researchers-create-ai-worms-that-can-spread-from-one-system-to-another/ |access-date=2024-03-07 |website=Ars Technica |language=en-us}}</ref>
* March 29: [[XZ Utils backdoor]] is discovered.<ref>{{Cite web |title=A backdoor in xz |first=Jonathan |last=Corbet |website=LWN |url=https://lwn.net/Articles/967180/ |date=2024-03-29 |access-date=2024-04-03}}</ref>
* April 1: The Linux WALLSCAPE Bug is discovered.
* June 29: Brain Cipher - a variant of LockBit 3.0 Ransomware behind Indonesia's Data Center attacks.

== See also ==
* [[History of computer viruses]]
* [[List of security hacking incidents]]
* [[Timeline of computing 2020–present]]

== Notes ==
{{Notefoot}}

== References ==
{{Reflist}}

== External links ==
* [https://web.archive.org/web/20090502053018/http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=Government&articleId=9131924&taxonomyId=13&pageNumber=1 A short history of hacks, worms, and cyberterror] by Mari Keefe, Computerworld, April 2009
* [http://www.5thutility.co.uk/10-worst-computer-viruses-time/ 5th Utility Ltd list of the 10 worst computer viruses of all time]

{{Malware}}
{{Timelines of computing}}

[[Category:Computing timelines|viruses]]
[[Category:Malware]]
[[Category:Trojan horses]]