A developer left the company in March. On June 30, a script hidden inside a routine maintenance job deleted payroll records. Code review shows it checks the date and whether the developer's account still exists before running. Which malware type does this describe?
Select an answer to reveal the explanation.
Short Explanation
Think of it as a booby trap set with a timer and a tripwire. It sat quietly inside a normal job until the date came around and the developer's account was gone, then it went off. When you see trigger conditions like those, you're looking at a logic bomb.
Full Explanation
A logic bomb is malicious code that remains dormant until a specific condition is met, such as a date, an event or the absence of a particular account, and then executes its payload. Insiders sometimes plant logic bombs in scheduled or maintenance code before leaving, so that the damage occurs later and appears disconnected from them. A script that checks the date and whether the developer's account still exists before deleting payroll records is a textbook example. A keylogger captures keystrokes to steal credentials or other input; it collects data rather than destroying it on a trigger, and nothing here records typing. Spyware covertly gathers information and sends it to an attacker, whereas this code destroys data and sends nothing out. A worm self-propagates across systems by exploiting vulnerabilities, but this script stayed inside one maintenance job and depended on preset conditions rather than spreading. Exam caveat: the defining feature is the trigger; the payload can be deletion, corruption or anything else. Operational check: restore payroll data from backups, remove the script, review all scheduled jobs and code the developer touched for similar conditions, and require code review and change approval for maintenance scripts so a single developer cannot add hidden logic.