The term “computer virus” is often used in business as an umbrella label for any malicious software. Technically, however, it is a narrow category within the broader concept of malware — and in 2026 it represents only a small fraction of actual threats. This article breaks down the threat landscape and provides concrete recommendations for EU SMBs.
For broader cybersecurity defence context, see the pillar Cybersecurity of Company Data.
Malware Typology: What Is What
Virus (narrow definition)
The original meaning — a programme that spreads by attaching itself to other files and requires user action (opening the infected file). The classic PC virus from the 1990s that infected .exe files on floppy disks.
In 2026: a marginal threat. Modern operating systems have built-in anti-malware controls; file viruses are typically detected on write.
Worm
Self-propagating malware — does not need a host file, spreads on its own through network vulnerabilities. Classic examples: WannaCry (2017, exploited the EternalBlue SMB protocol vulnerability), NotPetya (2017, devastating attack on Maersk).
In 2026: following WannaCry/NotPetya, network operating systems are better patched, but still a threat with legacy infrastructure (Windows Server 2012, unpatched VPN gateways).
Trojan
Disguised as legitimate software. The most common entry vector in 2026 — a user downloads “cracked” software, a “free PDF converter”, or opens an infected attachment. The trojan, once executed, performs a malicious action (often installs further malware — ransomware, info-stealer).
Sub-categories:
- Banker trojan — steals banking credentials. Examples: Emotet, TrickBot, QakBot.
- RAT (Remote Access Trojan) — gives the attacker remote access to the device.
- Dropper — only installs further malware; is itself “clean”.
Ransomware
The king of cyber threats in 2026. Encrypts files on the device and/or network, demands a ransom for the decryption key. Modern ransomware often uses double extortion — if you do not pay, the data is published.
Top ransomware groups active in the EU in 2025/2026: LockBit (most active), BlackCat / ALPHV, Cl0p, Royal, Akira. They target mid-sized companies with revenue of 10–100 million.
Average damage from a single ransomware incident for an EU SMB: 80,000–350,000.
Spyware and Stealer
- Spyware — collects data about the user (keystrokes, screenshots, browser history).
- Info-stealer — specialised spyware for credential exfiltration. Examples: RedLine, Vidar, Raccoon. After infection, the attacker sells your corporate credentials on the dark web (typically 5–50 per record).
Rootkit
Hides its presence at a deep OS level. Often persists even after system reinstallation (firmware rootkits). Detection requires specialised tools (Microsoft Defender Offline scan, GMER, Malwarebytes Anti-Rootkit).
Fileless Malware
Runs only in RAM, has no file on disk — classic antivirus does not detect it. Uses legitimate OS tools (PowerShell, WMI, MSHTA) for malicious operations. In 2026 it represents 30% of advanced attacks.
Detection: exclusively via behaviour-based EDR.
Cryptominer
Uses corporate device computing power to mine cryptocurrency (typically Monero) for the attacker’s benefit. Symptoms: device slowdown, increased energy consumption, hardware wear. Less damaging than ransomware, but often an indicator of broader compromise.
Entry Vectors: How Malware Gets Into the Business
In 2026, three vectors dominate:
1. Phishing Email (60% of incidents)
The attacker sends an email with an infected attachment (often .zip, .iso, a macro-enabled .docx or .xlsm) or a link to an exploit kit. Opening the file or enabling macros launches the malware.
Defence:
- Email gateway with anti-phishing and attachment sandbox (Microsoft Defender for Office 365, Proofpoint, Mimecast)
- Default-disabled macros in Office applications
- URL rewriting (clicks route through a security proxy)
- Employee training
2. Compromised Software Vulnerabilities (25%)
The attacker exploits an unpatched vulnerability in the company’s software — most commonly:
- VPN gateways (Fortinet, Pulse Secure, SonicWall — repeatedly targeted)
- Email servers (Exchange ProxyShell, ProxyLogon)
- Web applications (vulnerable plugin, SQL injection)
- Driver bugs in Windows / macOS
Defence:
- Monthly patch cycle
- Replace end-of-life software without exception
- Vulnerability scanning (Tenable Nessus, Qualys, Rapid7)
3. Compromised Credentials (15%)
The attacker obtains a password (from phishing, an info-stealer, or a leaked dump from another service) and logs in legitimately. Without 2FA, no defence catches this.
Defence:
- 2FA / passkey mandatory for all accounts
- Password manager (eliminates reuse)
- Dark web monitoring for leaked credentials (Have I Been Pwned, SpyCloud)
EDR vs. Classic Antivirus
The most important technology decision for endpoint security in 2026.
| Aspect | Antivirus (signature-based) | EDR (behaviour-based) |
|---|---|---|
| Known threat detection | Yes (~95%) | Yes (~98%) |
| Zero-day threats | Weak (~30%) | Good (~80%) |
| Fileless malware | No | Yes |
| Ransomware behavioural analysis | Limited | Yes |
| Forensic timeline after incident | Minimal | Full |
| Remote endpoint isolation | No | Yes (1 click) |
| Threat hunting capability | No | Yes |
| Cost (per seat/month) | 2–5 € | 5–15 |
Recommended EDR vendors for EU SMBs:
- Microsoft Defender for Endpoint (often included in M365 E5) — best value for companies already in the Microsoft ecosystem
- CrowdStrike Falcon — premium segment
- SentinelOne — strong in autonomous response
- ESET PROTECT — strong value in the EU SMB segment
- Bitdefender GravityZone — strong in EU SMB segment
Ransomware Defence: 7-Layer Approach
Ransomware is the most expensive category of incidents in 2026. Defence must be layered.
Layer 1: Entry Prevention
- Email security with sandbox
- Web filtering (block malicious domains)
- Patch management
- 2FA on all access points
Layer 2: Endpoint Protection
- EDR with ransomware behaviour detection
- Application allowlisting (Microsoft Defender Application Control)
- Disabled risky features (PowerShell remoting on endpoints, macros from the internet)
Layer 3: Network Segmentation
- Separation of production servers, office network, IoT
- No broad administrative shares (
\\server\admin$) - Microsegmentation in cloud environments
Layer 4: Identity Hardening
- Privileged Access Management (PAM) — admin account passwords held in a vault
- Just-in-time admin (admin rights only when needed)
- 2FA on all admin accounts (passkey preferred)
Layer 5: Backups 3-2-1-1-0
The most important defence. Without a functional immutable backup, ransomware is a business exit.
- 3 copies of data
- 2 different media types
- 1 off-site
- 1 immutable / air-gapped
- 0 errors on recovery test (once per year)
Layer 6: Detection and Response
- 24/7 SOC or MDR (Managed Detection and Response)
- Anomaly detection for ransomware indicators (mass file modification, encryption patterns)
- Incident response runbook with prepared steps
Layer 7: Cyber Insurance
Cyber insurance covers part of direct losses, legal costs, notification obligations, and sometimes the ransom. Cost: 5,000–25,000 per year for a mid-sized company.
Response to Infection: 5 Immediate Steps
If you suspect or confirm that a device is infected:
- Immediately disconnect from the network — unplug the Ethernet cable, disable Wi-Fi. Goal: stop the spread and cut communication with the attacker’s command-and-control server.
- Do not turn the device on or off — preserve the RAM state for forensic analysis. Many critical clues (process tree, network connections, decryption keys) exist only in RAM.
- Report to IT immediately — by phone, via another device, via Slack/Teams from a different computer. Never from the infected device.
- Do not use other corporate systems from the device — do not enter passwords, do not check email. If you have entered credentials in the last few hours, change them immediately from another device.
- IT will perform:
- Forensic analysis (scope of compromise, indicators of attack)
- Network isolation
- User credential reset
- Forensic disk image (for potential later investigation)
- Recovery from backup or OS reinstallation
For Ransomware: DO NOT Pay the Ransom
Law enforcement agencies and EU cyber authorities (ENISA, national CERTs) advise against payment for three reasons:
- There is no guarantee of a working key — 35% of those who pay receive nothing or only a partial key.
- It funds further attacks — ransomware groups scale with income.
- It may violate EU sanctions — if the group is on a sanctions list (LockBit, certain actors of Russian origin), payment constitutes a sanctions violation.
Better to invest in recovery from backup and in prevention for the future.
Notification Obligations
Following a serious incident, you have statutory reporting obligations:
- GDPR Article 33 — incident with risk to data subjects’ rights: supervisory authority within 72 hours
- GDPR Article 34 — high risk: notification of data subjects
- NIS2 — regulated sectors: competent national authority early warning within 24h, formal report within 72h
- DORA — financial sector: relevant national financial regulator
- Contractual — clients often have 24–72h notification clauses in their contracts
Prepare notification templates in advance so that during an incident you do not lose critical hours.
Modulario and Malware Defence
Modulario has built-in measures that prevent many infection vectors:
- EU hosting with ISO 27001-certified infrastructure — security monitoring, EDR on all servers
- Encrypted backups with 7-day immutability — ransomware via the provider’s infrastructure is practically excluded
- Sandbox for file uploads — uploaded attachments are scanned
- Rate limiting and anomaly detection in the API
- Audit log of every action, providing a forensic trail after an incident
For broader corporate cybersecurity measures, see the pillar Cybersecurity of Company Data and the cluster article Internet Security for Businesses.
Frequently Asked Questions
What is the difference between a virus and malware? Malware is the umbrella term for any malicious code — viruses, trojans, ransomware, spyware, worms. A virus is a specific type of malware that spreads by attaching itself to other files and requires user action (opening the file). In 2026, the classic virus is only a small fraction of threats — dominant are trojans (90% of infections) and ransomware.
Is a classic antivirus sufficient? In 2026, no. Classic signature-based antivirus products detect only known threats and are effective against 60–70% of attacks. Modern EDR (Endpoint Detection and Response) systems use behaviour-based detection that also catches unknown (zero-day) threats. For business deployment, EDR (Microsoft Defender for Endpoint, CrowdStrike, SentinelOne, ESET PROTECT) is the mandatory standard; classic antivirus is insufficient.
What should I do if a computer is infected? Five immediate steps: (1) disconnect the device from the network (Ethernet cable + Wi-Fi) to prevent the malware from spreading, (2) do not turn the device on or off — preserve the state for forensic analysis, (3) report to the IT department or via the internal #security-incident channel, (4) DO NOT enter passwords or connect to other services from the device, (5) IT performs forensic analysis, isolation, and recovery. For ransomware: DO NOT pay the ransom — it usually does not help, funds attackers, and may also violate sanctions regulations.