A computer worm is malware that spreads on its own — no click, no attachment, no person in the middle. It copies itself from machine to machine across networks, usually by exploiting a security hole in software the moment it finds one exposed. That self-spreading behaviour is what separates a worm from a trojan, and it is why a single worm incident can hit every unpatched device on a network in hours. This guide explains how worms work in 2026, what famous outbreaks taught the industry, and how to make your business a dead end for them.
TL;DR
- A worm is self-replicating malware: it spreads across networks by exploiting software vulnerabilities, without user action.
- Classic outbreaks — Conficker (2008) infected millions of machines through an unpatched Windows flaw — shaped the patching discipline the industry still runs on.
- Modern worms ride on exposed services, weak passwords, and IoT devices with default credentials.
- Patching, segmentation and closing exposed services stop worms; staff training catches the phishing that often installs them.
- Cyber Aware's security awareness training targets the delivery step worms still depend on.
What a worm is
Three malware classes get confused constantly, so the boundary is worth drawing:
- A virus infects other files when they are shared, and needs someone to run an infected file.
- A trojan disguises itself as useful software and needs a person to install it.
- A worm needs nobody. It scans the network, finds a machine running software with a known hole, exploits it, copies itself across, and starts scanning again.
Because no human decision is required, worm outbreaks grow exponentially — each infected machine becomes a new attacker. That is what made historical incidents like Blaster (2003), Sasser (2004) and Conficker (2008) famous: millions of machines infected within days of the flaw becoming public knowledge.
How worms spread in 2026
The classic worm scanned Windows file shares and unpatched services. The modern population targets the same weaknesses with better tooling:
- Unpatched internet-facing services. A server or appliance running old software with a known remote vulnerability — the worm exploits it directly. This is how the 2017 WannaCry and NotPetya outbreaks tore through tens of thousands of organisations worldwide.
- Weak and default passwords. Worms that brute-force or use default credentials on routers, NAS devices and admin panels. Mirai (2016) built a botnet of hundreds of thousands of cameras, routers and DVRs largely by trying factory passwords.
- Exposed remote-desktop and database services. RDP, SMB and database ports open to the internet — found by scan, exploited by worm, reused as entry point.
- Removable media. USB worms like Stuxnet (the 2010 worm that damaged Iranian nuclear centrifuges) jump air-gapped networks via infected drives — rare, but the reason USB policies exist.
- Email with a worm payload. Some worms blur the line by sending themselves to every contact in an infected mailbox — which returns the fight to the human layer.
What a worm costs a business
Worm damage comes in four forms: the resources consumed by the infection itself, the downtime while it is contained, whatever the worm delivers (some worms are just carriers that drop ransomware as a payload), and the recovery effort across every affected machine. Because spread is automatic, an outbreak does not stop at one device — it stops at the last patched machine or the last segmented network.
The Australian context puts the stakes in scale: the Australian Signals Directorate logged more than 84,700 cybercrime reports in 2024-25 — one every six minutes — with the average self-reported cost for a small business at $56,600, up 14 per cent (ASD Annual Cyber Threat Report 2024-25). A worm outbreak is the fastest way for a small business to end up in that statistic, because one unpatched machine can spread it to all the others.
Signs of a worm on the network
- Sudden, widespread slowdown across multiple machines at once — not one laptop, the whole office.
- Unexplained network traffic, especially outbound scanning patterns visible in firewall or router logs.
- Services crashing or restarting on their own across several devices.
- Unexpected admin accounts, or machines rebooting without anyone requesting it.
- Antivirus or firewall settings changing on their own across multiple devices.
A worm outbreak announces itself through scale: when many devices misbehave simultaneously and nobody installed anything, think self-spreading malware first.
How to stop worms
- Patch fast, and prioritise internet-facing systems. Every historical worm exploited a vulnerability whose fix already existed. Automate patching on servers, routers, printers and anything else that talks to the network.
- Close what does not need to be exposed. RDP, SMB, database and admin ports belong behind a VPN, not on the open internet. An attack-surface check or a security gap assessment shows exactly what you are exposing today.
- Segment the network. Separate guest Wi-Fi from staff devices, IoT from servers. Segmentation caps how far an outbreak travels in the first hour.
- Remove default and weak credentials on every router, camera, NAS and appliance — the Mirai recipe works only where factory passwords survive.
- Run endpoint protection everywhere, including the devices people forget: printers with embedded OSes, NAS boxes, IoT sensors.
- Keep backups offline or immutable, because a worm may be carrying ransomware.
- Train the human step that remains. Email-propagated worms and the phishing that installs their modern equivalents are stopped by a workforce that reports rather than clicks. Monthly security awareness training, simulated phishing and same-day remediation close the loop, and human risk reporting shows whether the behaviour is shifting.
Why this matters for Australian businesses
Worms sit at the intersection of the three controls Australian frameworks care most about: patching (Essential 8's first strategy), restricting administrative privileges, and multi-factor authentication on exposed services. SMB1001 and cyber insurers ask the same questions. A business that can evidence those three is a dead end for the worm classes that still circulate; a business that cannot is the target the worm scans for. The gap between the two is exactly what a cyber security gap assessment measures.
FAQ
What is a computer worm in simple terms? Malware that copies itself from computer to computer across a network without any user action, usually by exploiting a software vulnerability it finds on its own.
How is a worm different from a virus? A virus infects files and spreads when people share and open them; a worm spreads itself automatically across networks. No click is required for a worm to travel.
Can worms still spread in 2026? Yes — but the targets have shifted from Windows file shares to exposed remote-access services, unpatched appliances and IoT devices with default passwords. The technique is old, the target list is modern.
What was the most famous computer worm? Conficker infected millions of machines worldwide in 2008 by exploiting a Windows vulnerability. WannaCry in 2017 showed the modern pattern: a worm that delivered ransomware and disrupted hospitals, railways and businesses across dozens of countries.
How do I know if my network has a worm? Widespread simultaneous slowdown, unexplained network scanning traffic, services crashing on many machines at once, and settings changing by themselves. Confirm with a full endpoint scan and review of firewall logs.
Does MFA stop worms? It stops the credential-based variants from logging into exposed admin panels and remote-desktop services. It does not patch the vulnerability itself, so it is one layer alongside patching and closing exposed ports.
One last thing
Run one check today: list every device on your network that exposes a management port (RDP, SSH, admin web panels) to the internet. Every one of those is the front door a worm looks for. Move them behind a VPN or close them — that afternoon of work removes the attack vector every historical worm outbreak used.
Related guides
- What is a botnet? — what worm-infected device fleets become.
- What is ransomware? — the payload modern worms increasingly carry.
- Compare awareness platforms — how delivery models differ.