Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Computer viruses and other malware are created by people who write or maintain malicious code—but they are not always the people who distribute it or use it in an attack. Some work alone; others participate in criminal groups or provide tools and services to other criminals. The available official advisories describe particular malware ecosystems, not one universal developer profile.
Who creates computer viruses?
“Virus” is often used casually to mean any malicious software. Malware is the broader and more accurate term: it includes viruses as well as other kinds of harmful software. The people who create or maintain that code are malware developers. They may work alone, within a group, or as providers in a criminal services market.
Developers are not necessarily the people who get malware onto a victim’s device. CISA and the Australian Cyber Security Centre describe a criminal market in which developers create malware and distributors may broker it to end users. In their 2021 Top Malware Strains advisory, the agencies summarize the roles this way: “In the criminal malware industry, including malware as a service (MaaS), developers create malware that malware distributors often broker to malware end-users.” The advisory was published in 2022 and describes activity involving malware strains from 2021; it is historical evidence, not a current threat ranking.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Developers create or maintain malware code and may update it.
- Distributors or brokers supply or broker malware to others.
- Operators or affiliates use malware or a criminal service to carry out attacks. The term affiliate is used in some ransomware operations.
These roles can overlap, but they should not be treated as interchangeable. In particular, evidence about one operation does not establish that all malware follows the same division of labor.
#1 Best Overall
Why do people develop malware?
Financial gain is a documented incentive in the criminal ecosystems covered by the cited advisories. Malware can be sold, leased, or offered as part of a service, allowing its developer or provider to earn money without personally choosing and attacking every victim. That evidence does not establish a single motive shared by all developers, or a single personal profile.
Some developers have marketed tools such as Remcos and Agent Tesla as legitimate remote-management or penetration-testing products, while malicious actors have used them for harmful purposes, according to the CISA and ACSC advisory. A vendor’s description of a tool does not prove that every use is benign; the advisory’s point is that tools presented in one way can be used maliciously.
How do malware-as-a-service and ransomware-as-a-service differ?
Both models can separate the people who maintain a tool from those who use it. They are examples of criminal specialization, not universal arrangements for malware.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitches| Model | What is supplied | Who may maintain or distribute it | How operators may be compensated | Who targets victims |
|---|---|---|---|---|
| Malware-as-a-service (MaaS) | Malware access or related services; the 2021-strains advisory describes distributors brokering malware to end users. | Developers create and may improve malware; distributors or brokers may supply it. The advisory does not specify one payment arrangement for MaaS. | Not stated as a general MaaS arrangement in the CISA and ACSC advisory. | End users or other malicious actors may deploy it; roles vary by ecosystem. |
| Ransomware-as-a-service (RaaS) | Access to ransomware functionality maintained by a criminal group or service provider. | A group maintains the ransomware and sells access to operators, often called affiliates. | Upfront payments, subscriptions, a share of profits, or a combination, according to the CISA, FBI, and MS-ISAC LockBit advisory. | Operators or affiliates can select and attack victims; the service provider and operator need not be the same party. |
The LockBit advisory is a 2023 account of a specific ransomware operation, including changes to that operation. Its timeline should not be generalized to other malware or treated as a live assessment of current activity.
How can malware change and persist?
Developers may update malware, and code may be reused. CISA and ACSC identify both developer updates and code reuse as factors contributing to the longevity and variation of the strains discussed in their 2021 advisory. This helps explain how a malware family can evolve, but it does not establish why every individual family persists or how long it will remain active.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What this means for protecting your devices
Knowing that a developer may be separate from an operator can clarify how attacks are organized, but it does not identify who is behind a particular infection. Defensive practices reduce risk and improve recovery; they do not guarantee prevention or reveal a malware author. The #StopRansomware Guide recommends measures including:
- Use multifactor authentication.
- Keep offline backups and plan how to recover from an incident.
- Keep software and firmware up to date.
The guide was issued in 2023 by CISA, the FBI, the NSA, and MS-ISAC. Its recommendations are defensive measures, not a way to attribute malware to a particular developer.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
