# What is a Computer Worm?

> A computer worm is a self-contained, self-replicating program that can propagate a working copy to other systems, usually through network mechanisms, without attaching to a host program.

- Canonical URL: https://yellowcube.eu/glossary/computer-worm/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

Replication does not require user intervention, although initial execution or a particular path may still depend on exploitation, stolen access, unsafe configuration, or user action.

A worm commonly discovers targets, transfers or exploits its way in, launches a copy, and repeats. Propagation can consume network, processor, memory, and service capacity even without a destructive payload. It may also install ransomware, spyware, a rootkit, or other components.

### Key points

- **Propagation paths:** Worms can exploit services, reuse credentials, copy through shared resources, or abuse messaging and management channels. Each path needs suitable containment and evidence.
- **Containment:** Restrict affected paths, protect essential services, segment proportionately, and remediate the propagation mechanism. Large-scale blocking must account for operational dependencies.
- **Investigation:** Establish the earliest affected systems, direction and timing of spread, exploited weakness or account, secondary payloads, and telemetry gaps.
- **Important limitation:** Widespread infection is not automatically a worm. A controller can deploy malware without self-replication, while a worm may remain constrained by topology, permissions, or incompatible targets.

### Related terms

[Malware](<https://yellowcube.eu/glossary/malware/>) · [Computer virus](<https://yellowcube.eu/glossary/computer-virus/>) · [Botnet](<https://yellowcube.eu/glossary/botnet/>) · [Lateral movement](<https://yellowcube.eu/glossary/lateral-movement/>) · [Network segmentation](<https://yellowcube.eu/glossary/network-segmentation/>)

### Sources

[NIST glossary: Worm](https://csrc.nist.gov/glossary/term/worm) · [NIST SP 800-83 Rev. 1: Guide to Malware Incident Prevention and Handling](https://csrc.nist.gov/pubs/sp/800/83/r1/final) · [NIST SP 800-82 Rev. 3: Guide to Operational Technology Security](https://csrc.nist.gov/pubs/sp/800/82/r3/final)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.