The History of Malware- From Floppies to Droppers
Where
Common Ground
BSides Las Vegas
Duration
55 min
Traces malware from 1980s boot sector viruses and floppy-disk ransomware through macro viruses and botnets to modern droppers.
Summary
The talk opens with the 1989 AIDS Trojan, which was distributed on floppy disks and locked victims' files until a ransom was paid. From there the speaker follows how malware moved from a curiosity into a serious threat. Early programs such as Creeper and Reaper, and a 1984 magazine column that exposed readers to real viruses, show how the idea of self-replicating code took hold. The talk then covers DOS boot sector viruses, polymorphic infectors, and destructive payloads, noting how each era combined novelty with growing damage.
The middle section covers the shift to networks and documents. Macros in Office 95 enabled macro viruses, and Melissa and later worms spread through email at a scale that disrupted large companies. Remote access trojans such as NetBus and Back Orifice made backdoors common, and combining worms with command-and-control channels produced botnets. Those botnets were monetized through spam, denial-of-service rental, and banking theft, and ransomware eventually became a final payload dropped onto infected machines.
The closing part links this history to the present. Cryptocurrency and widely exploitable vulnerabilities made ransomware more profitable, and the speaker suggests AI-assisted malware may follow the same pattern, where early experiments later become serious threats. The practical takeaway is that many current attack chains still reuse old techniques, such as macros delivered through phishing, so understanding past malware helps explain today's defenses.
Related talks
Talks·49 min
Scott Small
Shows how ransomware and malware families change their behaviors over time and how TTP intelligence helps defenders keep pace.
Black Hat·10 min
Industry experts analyze emerging threats surrounding From Ransomware to RansomOps: Evolution of A Threat.
Talks·23 min
Stuart Ashenbrenner · Alden Schmidt
Traces a North Korean macOS intrusion from fake meeting lure through process injection to a keylogger and crypto-wallet stealer.


