Computer worm
Also known as: worm, network worm, internet worm
A computer worm is a type of malware that spreads on its own from one computer to another, usually by exploiting security flaws or weak passwords, without needing a person to open a file.
Because worms copy themselves automatically, they can infect huge numbers of systems in hours. While classic worm outbreaks have become rarer thanks to automatic updates and firewalls, events like WannaCry showed that unpatched networks remain vulnerable.
Computer worm, explained at three levels
At home
A worm spreads like a cold through a classroom: nobody has to do anything wrong except sit near someone who's sick. Once it infects one computer, it searches the network for other machines with the same unpatched weakness or weak password, copies itself onto them, and each new victim starts searching too. That's how worms can reach huge numbers of computers within hours.
At work
A computer worm is malware that copies itself from machine to machine across a network, usually through an unpatched flaw or weak password, with no one clicking anything. Because every infected computer helps spread it, a worm can reach a whole company network in minutes. Businesses defend by patching quickly, especially for flaws flagged as wormable, and separating networks so an outbreak can't reach everything.
At home
A worm spreads without anyone clicking anything. Once it infects a computer, it scans the network and the internet for other machines with the same weakness, such as an unpatched service or a weak password. When it finds one, it copies itself across and runs there, and that new victim starts scanning too. Because each infected machine recruits more, worms can grow exponentially, infecting huge numbers of computers within hours.
At work
Worms need a reliable, automatic way in: a network service flaw, weak or default credentials, removable media autorun, or email that recipients open. Many modern ransomware strains include worm-like spreading through SMB admin shares and stolen credentials. Because worms move fast, containment means isolating network segments, blocking the exploited ports at internal firewalls, and patching or disabling the vulnerable service everywhere at once. Waiting to investigate each machine individually lets the worm stay ahead of responders.
At home
WannaCry in 2017 spread through a Windows file-sharing flaw that Microsoft had patched about two months earlier. Computers that had installed the update were safe, while those that had not were encrypted within minutes, including large parts of the UK's National Health Service. A worm finds every unpatched machine automatically. In my view, that makes automatic updates the most underrated protection you have, because they close the door before a worm comes looking.
At work
Worm defence is mostly about removing the paths they need. Disable legacy protocols such as SMBv1, block inbound file sharing and RDP between workstations with host firewalls, segment networks so one infected zone cannot reach every other, and patch internet-facing and widely deployed services on emergency timelines. Exploits for wormable bugs, such as BlueKeep or EternalBlue, should trigger out-of-cycle patching. Incident plans need fast isolation steps, since automated spread outpaces manual triage.
Real-world examples
At home
Thomas remembers his university's computers slowing to a crawl in 2003 when the Blaster worm spread across campus. The IT team spent days patching every machine.
At work
Lena is IT manager at a Moncton manufacturing plant. During WannaCry, older factory computers were at risk, so she isolated them from the office network and applied emergency patches.
How it compares
| feature | Computer worm | Computer virus |
|---|---|---|
| Needs a host file | No | Yes, attaches to files |
| Spreads by itself | Yes, across networks | When infected files are shared or run |
| Speed | Very fast | Slower |
| Main defence | Patching and segmentation | Antivirus and safe file habits |
Viruses ride along with files. Worms travel on their own.
For analysts
I'd make sure patching covers every networked device, including old ones nobody likes to touch. Worms find the one machine everyone forgot.
History & origin
On November 2, 1988, Cornell graduate student Robert Tappan Morris released the Morris worm, which infected an estimated 6,000 computers, roughly a tenth of the internet at the time, and led to the first felony conviction under the US Computer Fraud and Abuse Act. The ILOVEYOU worm in May 2000 spread through email and caused billions of dollars in damage. Code Red in 2001, Blaster in 2003, and Conficker in 2008 spread through Windows flaws. Stuxnet, discovered in 2010, was a worm built to sabotage Iran's nuclear program. In May 2017, WannaCry used the leaked NSA exploit EternalBlue to infect hundreds of thousands of computers worldwide, disrupting the UK's National Health Service. In my view, the Morris worm was the internet's first real wake-up call, and WannaCry proved we kept hitting snooze.