Botnets, Droppers/Loaders, Ransomware, Wipers

• Botnet: fleet of compromised hosts under central command-and-control (C2). Example: Mirai (IoT DDoS, 2016).
• Dropper / Loader: stages and installs later payloads; often the first thing you actually catch. Example: Emotet.
• Ransomware: encrypts data and extorts payment. Example: LockBit.
• Wiper: destroys data, only pretending to be ransomware. Examples: NotPetya (2017), HermeticWiper (2022).