The (Un)Natural History of Malware

Download Chapter 1: ILOVEYOU

ILOVEYOU spread across the globe in seventy-two hours and infected fifty million systems. Stuxnet destroyed centrifuges at a nuclear facility without firing a shot. WannaCry paralyzed hospitals across four continents on a Friday afternoon. We have names for these things. What we don't have is a way to look at them.

Lena Yu does. A compiler researcher turned malware analyst, she has spent years treating malware the way a Victorian naturalist would treat a newly discovered species: with observation, taxonomy, illustration, and disciplined curiosity about what the organism actually does.

The (Un)Natural History of Malware catalogs ten landmark specimens: ILOVEYOU, Nimda, SQL Slammer, Gh0st RAT, Stuxnet, Flame, Industroyer, TrickBot, WannaCry, and Raspberry Robin. Each is documented in formal field notes, its anatomy mapped to function, its behavior explained ecologically, its history traced with care. Each is hand-drawn in the style of nineteenth-century natural history engravings and given a formal Lenaean name encoding its habitat, behavioral strategy, and defining trait. ILOVEYOU becomes Winwormia Infector Loveletterius. Stuxnet becomes Winwormia Destoryor Centrifugium. Invasive species, parasites, predators, swarming colonies: seen this way, the famous names of malware history stop being code and start being organisms you can observe.

Part pop science, part security history, part naturalist's sketchbook. For the analyst who wants to think differently about what they study, and for anyone who has ever wondered what, exactly, these things are.