Malware and cyber defence, explained
Famous malware attacks: a timeline from 1986 to 2023
The most famous malware attacks include the Morris worm (1988), ILOVEYOU (2000), SQL Slammer (2003), Conficker (2008), Stuxnet (2010), WannaCry and NotPetya (2017), and the SolarWinds supply-chain attack (2020). This timeline lists 18 outbreaks from 1986 to 2023, what each one did, and a source for every fact. The whole table is a free CSV you can reuse.
The timeline
Each row is one outbreak, with how it spread and what made it matter. Numbers are the estimates the source gives; for most outbreaks nobody knows the exact count.
| Year | Name | Type | How it spread | What happened | Source |
|---|---|---|---|---|---|
| 1986 | Brain | Virus | Boot sector of floppy disks | Considered the first virus for IBM PCs; written by brothers Basit and Amjad Farooq Alvi in Lahore, Pakistan. | wikipedia.org |
| 1988 | Morris worm | Worm | Flaws in sendmail and fingerd, and weak passwords | Usually reported to have infected around 6,000 machines; it led to the creation of CERT/CC, the first computer emergency response team. | wikipedia.org |
| 1999 | Melissa | Macro virus | Infected Word document sent by email | Mailed itself to the first 50 entries in each victim's Outlook address book, overloading email servers. | wikipedia.org |
| 2000 | ILOVEYOU | Worm | Email attachment disguised as a love letter | Released on 4 May 2000 from the Philippines; infected tens of millions of computers and overwrote files. | wikipedia.org |
| 2001 | Code Red | Worm | Buffer overflow in Microsoft IIS web servers | Infected more than 359,000 servers in under 14 hours on 19 July 2001. | caida.org |
| 2003 | SQL Slammer | Worm | One 376-byte network packet to Microsoft SQL Server | Infected most of its 75,000 victims within 10 minutes, the fastest-spreading worm recorded at the time. | caida.org |
| 2003 | Blaster | Worm | Flaw in the Windows DCOM RPC service | Made infected PCs reboot and was programmed to flood windowsupdate.com, the site that held its fix. | wikipedia.org |
| 2004 | Sasser | Worm | Flaw in the Windows LSASS service | Spread with no user action at all; written by an 18-year-old in Germany, found through a Microsoft bounty. | wikipedia.org |
| 2008 | Conficker | Worm | Windows flaw MS08-067, weak passwords and USB drives | Estimated 9 to 15 million infected computers by January 2009, in over 190 countries. | wikipedia.org |
| 2010 | Stuxnet | Worm (sabotage) | USB drives and four Windows zero-day flaws | Targeted uranium enrichment centrifuges in Iran; the first widely known malware built to cause physical damage. | wikipedia.org |
| 2012 | Shamoon | Wiper | Inside a corporate network | Overwrote over 30,000 Windows workstations at Saudi Aramco on 15 August 2012. | wikipedia.org |
| 2013 | CryptoLocker | Ransomware | Email attachments and the Gameover ZeuS botnet | Made ransomware paid in Bitcoin mainstream; cut off in 2014 by Operation Tovar, which took down its botnet. | wikipedia.org |
| 2016 | Mirai | Botnet | Internet-connected cameras and routers with default passwords | Used for the 21 October 2016 attack on DNS provider Dyn, which made major websites unreachable. | wikipedia.org |
| 2017 | WannaCry | Ransomware worm | EternalBlue exploit of Windows SMBv1 (MS17-010) | Hit more than 200,000 computers in at least 150 countries, including the UK's NHS, within days; slowed by a kill-switch domain. | wikipedia.org |
| 2017 | NotPetya | Wiper disguised as ransomware | Hijacked update of Ukrainian accounting software M.E.Doc | Spread worldwide through company networks; files could not be recovered even by paying. | wikipedia.org |
| 2020 | SUNBURST (SolarWinds) | Supply-chain backdoor | Trojanised updates of SolarWinds Orion software | Around 18,000 customers installed the backdoored update. | wikipedia.org |
| 2021 | Colonial Pipeline (DarkSide) | Ransomware | Stolen password for an unused VPN account without multi-factor authentication | The largest refined-fuel pipeline in the US shut down for five days; the US Justice Department later recovered 63.7 of the bitcoins paid. | wikipedia.org |
| 2023 | MOVEit (Cl0p) | Data-theft extortion | SQL injection zero-day in MOVEit Transfer (CVE-2023-34362) | Stole data from thousands of organisations without encrypting anything, then demanded payment not to publish it. | cisa.gov |
Download the data
The table is a free CSV with seven columns (year, name, type, how_it_spread, target, what_happened, source), one row per outbreak. Use it in a lesson, a slide, an article or a chart.
Download famous-malware-attacks.csv
Cite this (CC BY 4.0: free to reuse with credit)
M-Learn (2026). Famous malware attacks, 1986 to 2023 [Data set]. https://www.m-learn.app/learn/famous-malware-attacks. Licensed CC BY 4.0.
What the timeline shows
Four shifts stand out across 37 years of outbreaks.
- From pranks to profit. Brain, Melissa and ILOVEYOU did damage, but their authors earned nothing. From CryptoLocker in 2013 on, the big outbreaks are businesses.
- Worms made patching urgent. Code Red, Slammer, Blaster and Sasser all used flaws that already had fixes. WannaCry did the same in 2017, two months after Microsoft patched the flaw it used.
- Attackers moved up the supply chain. NotPetya rode a software update; SUNBURST rode another. One compromise of a trusted vendor reached thousands of its customers at once.
- Encryption is optional now. The 2023 MOVEit campaign stole data from thousands of organisations without encrypting a single file, and extorted them anyway. Backups protect against encryption, not against leaks.
For how the kinds in this table differ, see virus vs worm vs trojan and types of malware, compared. For how the most damaging kind works today, see how ransomware works.
Questions people ask
What was the first computer virus?
Brain, released in January 1986, is considered the first virus for IBM PC compatibles. Earlier self-copying programs existed on other systems, such as Creeper on ARPANET in the early 1970s and Elk Cloner on the Apple II in 1982.
What was the fastest-spreading worm?
SQL Slammer, in January 2003. A single 376-byte network packet was enough to infect a Microsoft SQL Server, and it infected most of its 75,000 victims within 10 minutes.
Can I use this dataset in my own work?
Yes. The CSV is licensed CC BY 4.0: you can copy, change and publish it, including commercially, as long as you credit M-Learn and link to this page. A ready-made citation is below the table.