The so-called long tail of the web attack methods spectrum (Figure 20) includes a collection of lower-volume malware types that are employed at a later stage in the attack chain: installation. In this phase, the threat that has been delivered—a banking Trojan, a virus, a downloader, or some other exploit—installs a back door in the target system, providing adversaries with persistent access and the opportunity to exfiltrate data, launch ransomware attacks, and engage in other mischief.

The threats listed in Figure 20 are samples of malware signatures found outside the top 50 most commonly observed malware types. The long tail of web attack methods is, essentially, a snapshot of threats that are quietly at work on a machine or system after a successful attack. Many of these infections were first spawned by an encounter with malicious adware or exposure to a wellcrafted phishing scam. These are situations that users can often easily avoid or quickly remediate.

High