tr
tr

The Autonomy Axis: How Malware Independence Reshapes Defense

Part 1 of a three-part synthesis of the Cybersecurity Defense Lab series

HOW TO

8/20/20269 min oku

The Question Behind Three Threats

Most malware taxonomies sort by damage: what does it destroy, what does it steal, what does it cost. This is useful for incident response but poor for architecture, because it tells you what happened without telling you what would have prevented it.

There is a different way to sort the same history — by autonomy. Not "what does it do?" but "what does it need in order to act?"

Ask that question of three threat classes and a pattern appears that is invisible when they are studied separately:

ClassRequiresDefensive center of gravityVirusA human decisionUser judgmentWormA reachable networkArchitectural isolationBotnetNeither — it persists and receives directionObservability

This article traces that progression, and argues for a claim that follows from it: defenses do not scale up the axis. A control that works at one level of autonomy does not merely become weaker at the next level — it becomes categorically inapplicable. Understanding why matters more now than it did a decade ago, because a new class of software sits at the top of this axis by design.

Level 0 — The Virus: Waiting for a Decision

A computer virus, in the strict sense, cannot start itself. It requires a host and it requires an action: a file opened, an attachment run, a disk inserted. Until that action occurs, the code is inert.

The first PC virus illustrates how modest the origins were. Brain (1986) was written by two brothers running a computer shop in Pakistan, intended to mark unauthorized copies of their own software. It was not designed to destroy anything. It escaped anyway, and became the first virus to spread internationally.

Fourteen years later, ILOVEYOU (2000) demonstrated the mature form of the same dependency. The code itself was unremarkable — no novel exploit, no clever evasion. What made it one of the most damaging outbreaks in history was the subject line. It targeted curiosity, not software. Organizations shut down mail servers not because the worm had breached them, but because their own users kept opening the attachment.

The defining property of this level is that the attacker's final step is performed by the victim. This has a direct architectural consequence: the effective control is a decision gate. Something must interrupt the chain between intention and execution, and require an explicit, informed confirmation.

Note what does not help much at this level. Network isolation is irrelevant — the user is inside the boundary. Monitoring helps you discover the breach afterward, not prevent it.

Level 1 — The Worm: Waiting for Nothing but Reachability

In November 1988, a graduate student at Cornell released a self-replicating program onto a network of roughly 60,000 machines. The Morris Worm was not designed to destroy data; the author's stated intent was to measure the size of the internet. A flaw in its reinfection logic caused it to copy itself onto already-infected hosts repeatedly, exhausting their resources.

The commonly cited figure is that around 6,000 machines — about ten percent of the connected internet — were affected within 24 hours. This number appears on the FBI's own account of the case.1 It is worth noting that the figure is contested: Paul Graham, who was present when the estimate was produced, described it as a guess (10% of an assumed 60,000 hosts), and Clifford Stoll estimated the true number at "only a couple thousand."2 The imprecision is itself historically interesting — the incident occurred before anyone had instrumentation capable of measuring it.

What is not disputed is the qualitative shift. No user did anything. The worm found hosts, exploited them, and moved on. The incident produced the first felony conviction under the U.S. Computer Fraud and Abuse Act, and prompted the creation of CERT/CC — the first coordinated incident response body.

Fifteen years later, SQL Slammer (2003) showed what the same principle looks like when optimized. The worm was 376 bytes — small enough that it and its headers fit in a single 404-byte UDP packet, requiring no connection handshake before infecting a target. CAIDA's analysis measured a doubling time of 8.5 ± 1 seconds and found that more than 90 percent of vulnerable hosts were infected within ten minutes. At least 75,000 hosts were compromised.3

The consequences reached well outside the network: 13,000 Bank of America ATMs disconnected, airline flights cancelled, and disruptions to election systems and 911 services.4 The worm carried no destructive payload. The damage was a side effect of the traffic it generated while replicating.

Two structural lessons follow. First, user education is not a control at this level. There is no decision to intercept. Second, exponential propagation is not a metaphor. A doubling time measured in seconds means that any human-in-the-loop response — noticing, deciding, acting — is arithmetically too slow. The only controls that operate on that timescale are ones that were already in place: patching, network segmentation, and least privilege.

Level 2 — The Botnet: Persistence and Direction

A worm's autonomy is real but shallow. It executes a fixed program. Once you understand what it does, you know everything it will ever do.

A botnet is different in kind. The compromised host does not merely run code — it waits for instructions. Its behavior is not determined at the time of infection. This makes the relevant question not "what does this malware do?" but "who is currently directing it, and toward what?"

Removing the single point of failure

Until 2007, botnet takedowns followed a reliable pattern: find the command-and-control server, seize or sink it, and the network goes dark.

Storm broke that pattern by having no central server. Each infected host both received and relayed instructions — a peer-to-peer architecture with no head to remove. Researchers at USENIX LEET measured the network's reach and observed more than 1.7 million distinct IP addresses across 210 countries during their study period.5 The number does not map cleanly onto infected machines — dynamic addressing inflates such counts — but the geographic spread is meaningful on its own.

The defensive implication is significant: for the first time, security teams could observe a botnet in detail while being unable to disable it.

Profitability without destruction

Storm demonstrated resilience. 3ve (active 2016–2018) demonstrated something subtler: a botnet that causes no visible harm to the machine it occupies.

3ve controlled more than 1.7 million computers, running hidden browsers that visited counterfeit websites and loaded advertisements. According to the U.S. Department of Justice, the bots simulated human behavior convincingly enough to include mouse movement and video playback.6 The victims were not the machine owners — they were advertisers paying for impressions delivered to nobody.

Nothing was encrypted. Nothing was deleted. No ransom note appeared. From the perspective of a user, and from the perspective of most endpoint defenses, nothing was wrong. The operation ran for roughly two years.

This is a direct challenge to detection strategies built around damage. If harm is the signal, an attack that causes no local harm is invisible.

Infrastructure, not attack

By 2023, the mature form had arrived. Qakbot had infected more than 700,000 computers worldwide. Its function was not to attack those machines but to sell access to them: the operators collected roughly $58 million in fees from ransomware payments between October 2021 and April 2023, providing initial access to groups including Conti, REvil, and Black Basta.7

The takedown, Operation Duck Hunt, is instructive precisely because of what it was not. The FBI did not shut the network down. Having obtained the botnet's encryption keys, investigators gained control of its own communication tier and used that infrastructure to deliver an uninstaller to infected machines.8

Consider what this required. Not perimeter defense — the machines were already compromised, in many cases for a long time. Not user action — most owners never knew. It required detailed, accurate visibility into how the network communicated, sustained long enough to take it over from the inside.

That is an observability problem, not a prevention problem.

What Actually Changes Along the Axis

Reading the three levels together produces a pattern that none of them shows alone.

The attacker's dependency on the victim decreases monotonically. A virus needs a decision. A worm needs an open port. A botnet needs neither — it already has what it needs and is waiting.

The window for human response collapses. At Level 0, the window is however long the user hesitates before clicking. At Level 1, SQL Slammer's doubling time was 8.5 seconds — shorter than the time to read an alert. At Level 2, there may be no window at all, because there is no discrete event to respond to.

The relationship between damage and detection inverts. Early malware announced itself; damage was the detection mechanism. 3ve inverted this: the operation's success depended on causing no local damage whatsoever.

From these, the central claim of this article follows.

Defensive controls do not scale up the autonomy axis. Each level requires a defense class that the previous level did not need.

This is stronger than saying defenses get harder. Consider:

  • User training is the primary control at Level 0. At Level 1 it is not a weak control — it is not a control, because no user acts.

  • Network isolation is decisive at Level 1. At Level 2 it constrains a compromised host but does not reveal one. Qakbot-infected machines were behaving exactly as designed; segmentation limits blast radius but produces no signal.

  • Observability is what Level 2 requires — and it is expensive, ongoing, and produces no visible benefit while nothing is wrong. It is precisely the control most likely to be deferred.

The practical consequence is that a defensive posture assembled incrementally, in response to threats already experienced, will systematically lag. Each new level of autonomy demands a class of control that the organization has no prior reason to have built.

Where Agentic Software Sits on This Axis

There is a reason to revisit this taxonomy now rather than as history.

A modern AI agent — one that reads files, retrieves web content, calls tools, and acts on a user's behalf — occupies a position on this axis that has no precedent in benign software. It runs continuously. It acts without a discrete user decision per action. It ingests content from sources the user does not control. And it maintains outbound communication.

Structurally, those are Level 2 properties.

This is not an accusation; it is a description of what makes such systems useful. An agent that requires explicit approval for every read is not an agent. But it does mean that a security model borrowed from Level 0 — "the user will notice something suspicious" — is a category error when applied to agentic systems, for the same reason it was a category error against SQL Slammer.

The controls that history suggests are appropriate for this position are the Level 2 controls: least privilege by default, architectural isolation, and durable, inspectable records of what the system actually did. Not because agents are malicious, but because the autonomy that makes them useful is the same property that made Level 2 threats difficult.

Conclusion

Sorting malware by autonomy rather than by damage yields a claim that is testable against the historical record and applicable to system design:

  1. As autonomy rises, the victim's role in the attack chain diminishes toward zero.

  2. As the victim's role diminishes, controls that depend on victim judgment become inapplicable — not merely less effective.

  3. At the top of the axis, where behavior is determined after compromise rather than at compromise, prevention alone is structurally insufficient. Visibility becomes a primary control rather than a supporting one.

The Morris Worm was not stopped by anyone noticing it in time; in 1988 there was no instrumentation capable of noticing. Qakbot was dismantled precisely because, by 2023, there was.

That difference — the capacity to see what a system is actually doing — is the defensive lesson of the autonomy axis. It is also, not coincidentally, the hardest one to justify building before you need it.

References

Additional technical references

Video Companions

This article synthesizes three episodes of the Cybersecurity Defense Lab series:

  1. Federal Bureau of Investigation, "The Morris Worm: 30 Years Since First Major Attack on the Internet." https://www.fbi.gov/news/stories/morris-worm-30-years-since-first-major-attack-on-internet-110218 ↩

  2. Wikipedia, "Morris worm," citing Paul Graham and Clifford Stoll on the disputed infection estimate. https://en.wikipedia.org/wiki/Morris_worm ↩

  3. Moore, D., Paxson, V., Savage, S., Shannon, C., Staniford, S., & Weaver, N. "The Spread of the Sapphire/Slammer Worm." CAIDA. https://www.caida.org/catalog/papers/2003_sapphire/ ↩

  4. Ibid.; see also documented secondary effects on ATM, aviation, and emergency services infrastructure. ↩

  5. Holz, T., Steiner, M., Dahl, F., Biersack, E., & Freiling, F. "Measurements and Mitigation of Peer-to-Peer-based Botnets: A Case Study on Storm Worm." USENIX LEET '08. https://www.usenix.org/legacyurl/measurements-and-mitigation-peer-peer-based-botnets-case-study-storm-worm ↩

  6. U.S. Department of Justice, Eastern District of New York, press release on the 3ve/Methbot indictments. https://www.justice.gov/usao-edny/pr/two-international-cybercriminal-rings-dismantled-and-eight-defendants-indicted-causing ↩

  7. U.S. Department of Justice, Central District of California, "Qakbot Malware Disrupted in International Cyber Takedown." https://www.justice.gov/usao-cdca/pr/qakbot-malware-disrupted-international-cyber-takedown ↩

  8. Federal Bureau of Investigation, "FBI, Partners Dismantle Qakbot Infrastructure in Multinational Cyber Takedown." https://www.fbi.gov/news/stories/fbi-partners-dismantle-qakbot-infrastructure-in-multinational-cyber-takedown ↩

© 2026. All rights reserved.