At a university, a lab PC is slow, no files on it are encrypted, and a process has been injected into a signed binary. Which broad attack category fits?
Select an answer to reveal the explanation.
Short Explanation
A hand slipped into a trusted coat is still theft, even when nobody left a ransom note on the sidewalk. You have code injected into a signed binary and no encrypted files, so the broad category is malware. The trap is demanding a ransom note, blaming a phone call, or blaming a failed tap.
Full Explanation
Malware is unwanted code on a host, and process injection into a signed binary is a host-based malware technique even when no files are encrypted. The broad category is Malware on the endpoint, including code injected into a signed binary, with no ransom note. Ransomware specifically, the category that encrypts files and leaves a note demanding payment, needs that encryption or payment demand, and this PC has neither. A social-engineering phone call, a person persuading staff with no program added to the PC, has no injected process in it. A tap failure, a packet-copy path that stopped and cannot inject code into a signed binary, is a broken traffic copy and cannot place code inside a process. Slow performance alone is not the category; the injected code inside the signed binary is what makes this malware. Exam caveat: a lab debugger can inject into a signed binary on purpose, so confirm the injection was not an authorized exercise; a missing ransom note still does not move this into a phone call or a tap failure. Operational check: record the signed parent, the injected process, and the command line before you reboot the lab PC.