What Is Worm?

A worm spreads by itself, across networks, without anyone doing anything. That single property is what separates a contained incident from an organisation-wide outage, and it is why worm behaviour deserves attention even though the standalone worm is rare.

Modern malware is frequently worm-capable rather than being a worm: an encryption payload with a propagation module, or a loader that spreads laterally before deploying anything.

Propagation as the defining risk

Malware requiring user action spreads at the speed of human behaviour. Self-propagating malware spreads at network speed, which in a flat network means the entire estate in minutes rather than days.

That difference changes the response entirely. There is no time for deliberate investigation before containment, which is why propagation capability should be assessed as the first question about any active infection.

How it moves

Exploiting unpatched network services, which is the classic route. Using stolen credentials with administrative rights, which is the common modern one and requires no vulnerability at all.

Abusing legitimate management tooling — remote execution frameworks, deployment systems, scripting infrastructure — which is fast, reliable and looks like normal administration. That last route is why privileged access matters so much to blast radius.

Segmentation is the control that bounds it

A flat internal network means anything reaching one host can reach everything. Segmentation does not prevent infection and it determines how far infection travels, which is the variable that decides whether you have an incident or a crisis.

Restricting the protocols used for lateral movement between segments — file sharing, remote management, remote desktop — delivers most of the benefit without full micro-segmentation.

Containment when it is already spreading

Speed dominates. Blocking the propagation protocols at segment boundaries, disabling the accounts being used, and isolating affected segments rather than individual hosts are the actions that work at the necessary pace.

Having those actions pre-planned and pre-authorised is what makes them possible. A decision about network-wide blocking that requires escalation at two in the morning will be made too late.

The systems that cannot be patched

Medical devices, industrial controllers and legacy application servers are frequently both unpatchable and reachable, which makes them ideal propagation hosts. Several major outbreaks travelled through exactly this population.

Since patching is unavailable, the control is isolation: tight segments, explicit allowed flows, and monitoring of anything unexpected leaving them.

The outbreaks that shaped current practice

The major self-propagating events of recent years spread through a single unpatched network service and reached global scale within hours, including organisations that had the patch available and had not deployed it. Several also reached victims through a trusted software update rather than over the network.

The lessons that stuck are the two that remain hardest: patch internet-facing and widely reachable services on a timeline measured in days, and design internal networks so that reaching one host does not mean reaching all of them.

Where to start

Establish whether file sharing and remote management protocols are permitted between all your internal segments. If they are, you have no boundary to a worm outbreak.

See micro-segmentation, starting small. GuardsArm runs security program reviews.