The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Computer viruses and other malware are created by people who may work alone, as part of a criminal group, or as specialists in a wider malware market. The person who writes or maintains the code is not necessarily the person who distributes it or deploys it against victims. Official advisories describe these roles in particular criminal ecosystems, not a single profile shared by all malware developers.
Who creates computer viruses?
“Virus” is often used casually to mean any malicious software, but malware is the broader term. A virus is one type of malware; the advisories discussed here also cover other malware and ransomware. CISA and the Australian Cyber Security Centre (ACSC) describe a market in which developers create malware that distributors may broker to end users. Their advisory puts it this way: “In the criminal malware industry, including malware as a service (MaaS), developers create malware that malware distributors often broker to malware end-users.” CISA and ACSC’s 2021 Top Malware Strains advisory describes activity from 2021 and was published in 2022.
As an Amazon Associate I earn from qualifying purchases.
In practical terms, the roles can include:
- Developers: write, maintain, or update malicious code.
- Distributors or brokers: supply or broker malware to others.
- Operators or affiliates: use malware in attacks, including selecting or targeting victims in some criminal operations.
These roles can overlap, but they should not be treated as interchangeable. An advisory about one malware family or criminal operation documents that ecosystem; it does not establish a universal division of labor.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Why do people develop malware?
Financial gain is a documented incentive in the criminal contexts covered by the cited advisories. Some developers sell or provide access to malware, while other participants may earn money by deploying it. That evidence does not show that every malware developer has the same motive, or that all malware is created for the same purpose.
#1 Best Overall
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
Nor do the cited advisories establish a typical developer’s nationality, age, or personal background. There is no single profile supported by these sources. The evidence describes particular criminal markets and cases, rather than measuring malware developers as a population.
How malware services separate development from attacks
Criminal service models allow people to specialize. Malware-as-a-service (MaaS) and ransomware-as-a-service (RaaS) are related examples, but they do not describe every malware operation.
Rank #2
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
| Model | What the service provides | Who may maintain or supply it | How operators may get access or be compensated | Who targets and deploys it |
|---|---|---|---|---|
| MaaS | Malware offered through a criminal service market. | Developers create and may support, improve, or distribute malware; distributors may broker it to end users. | The 2021-strains advisory describes malware being brokered, but does not set out one universal payment arrangement. | End users or other malicious actors may use it; the advisory does not define a single operating model for all MaaS. |
| RaaS | Ransomware functionality and access to a ransomware operation. | A group may maintain the ransomware functionality and provide access to operators, often called affiliates. | Depending on the arrangement, affiliates may pay upfront, subscribe, share profits, or use a combination. | Operators or affiliates carry out attacks; their tasks may include choosing and attacking victims. |
The MaaS description comes from CISA and ACSC’s 2021 Top Malware Strains advisory. The RaaS description comes from CISA, FBI, and MS-ISAC’s 2023 LockBit advisory. The LockBit advisory is a dated example of a specific operation, not a timeline or blueprint for every ransomware group.
Why malware changes and persists
Malware is not necessarily a finished, unchanging program. CISA and ACSC report that developer updates and code reuse contributed to the longevity and variation of malware strains covered in their 2021 advisory. Updates can support continued development, while reused code can carry elements from one strain or version into another.
Rank #3
![Norton 360 Deluxe 2027 Antivirus, 3 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41qw3FS3qLL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 3 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
This helps explain how a malware family can persist or change, but it does not establish one cause for the continued existence of every malware family. The advisory’s examples describe historical activity from 2021; they are not a current ranking of threats.
What the evidence does—and does not—show
The advisories provide evidence about particular malware markets and ransomware operations. They do not quantify the overall population of malware developers or establish a general demographic or motive profile. Figures about a specific incident or operation should not be read as statistics about developers as a whole.
Rank #4
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
The 2021 advisory also notes that some developers market products such as Remcos and Agent Tesla as legitimate remote-management or penetration-testing tools, while malicious actors use them for harmful purposes. A product’s marketing description alone does not prove that a particular use is benign; context and conduct matter.
How to reduce ransomware risk
Defensive measures cannot identify who developed malware or guarantee that an attack will be prevented. CISA, FBI, NSA, and MS-ISAC recommend practices including:
Best Value
![Norton 360 Deluxe 2027 Antivirus, 5 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41IYV5zGyCL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 5 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
- Use multifactor authentication.
- Keep offline backups and plan how to recover from them.
- Keep software and firmware up to date.
See the agencies’ #StopRansomware Guide for further guidance.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
