A public-works technician installs a 'helpful' remote-support utility that arrived in email. Investigators later find a hidden backdoor. Which malware classification best fits the original installer?

A Trojan is malware delivered under the guise of legitimate software. When a public-works technician installs a seemingly helpful remote-support utility from email and investigators later find a hidden backdoor, the classification follows the delivery deception: the installer looked useful enough to run, then delivered unauthorized remote access. Municipal help-desk culture makes this especially dangerous because staff are trained to accept remote tools during outages, so social engineering rides that trust.

A worm that self-propagates across a VLAN without user action does not match an email-installed helper; worms spread autonomously and do not require the technician’s voluntary install as the defining step. Ransomware that encrypted file shares and left a payment note would present encryption and extortion indicators, which are absent from a backdoor discovery story. A rootkit that only hid processes after a clean OS reinstall describes concealment after deep persistence or reimaging contexts; the primary classification here is the deceptive installer delivering a backdoor, not post-reinstall hiding alone.

Exam caveat: Trojans, worms, ransomware, and rootkits can combine in real incidents, but exam items score the best fit to the described behavior. Appearance of legitimacy plus post-install backdoor equals Trojan delivery, not worm self-spread or ransomware encryption.

Operational check: remove the unauthorized remote tool, rotate credentials and tokens that may have been exposed, scan peer public-works hosts for the same installer hash, tighten email attachment and software-allow policies, and require vetted remote-support channels instead of ad-hoc email utilities.