Editing Trojan horse (computing) (section)

==Behavior==
Once installed, trojans may perform a range of malicious actions. Many tend to contact one or more [[Botnet#Command and control|Command and Control]] (C2) servers across the Internet and await instruction. Since individual trojans typically use a specific set of ports for this communication, it can be relatively simple to detect them. Moreover, other malware could potentially "take over" the trojan, using it as a proxy for malicious action.<ref name="Crapanzano2003"/>

In German-speaking countries, [[spyware]] used or made by the government is sometimes called ''govware''. Govware is typically used to intercept communications from the target device. Some countries like Switzerland and Germany have a legal framework governing the use of such software.<ref name="cupa">Basil Cupa, [http://www.zora.uzh.ch/81157/1/Cupa_Living_in_Surveillance_Societies_2012.pdf Trojan Horse Resurrected: On the Legality of the Use of Government Spyware (Govware)], LISS 2013, pp. 419–428</ref><ref>{{cite web
   |url=http://www.ejpd.admin.ch/content/ejpd/de/home/themen/sicherheit/ueberwachung_des_post-/faq_vuepf.faq_3.html
   |title=Häufig gestellte Fragen (Frequently Asked Questions)| publisher=Federal Department of Justice and Police
   |url-status=dead
   |archive-url=https://web.archive.org/web/20130506102113/http://www.ejpd.admin.ch/content/ejpd/de/home/themen/sicherheit/ueberwachung_des_post-/faq_vuepf.faq_3.html| archive-date=May 6, 2013}}</ref> Examples of govware trojans include the Swiss [[MiniPanzer and MegaPanzer]]<ref name="tech">{{cite web
   |last1=Dunn
   |first1=John
   |title=Swiss coder publicises government spy Trojan
   |url=http://news.techworld.com/security/3200593/swiss-coder-publicises-government-spy-trojan/
   |website=[[International Data Group|TechWorld]]
   |access-date=10 January 2021|archive-url=https://archive.today/20140126115729/http://news.techworld.com/security/3200593/swiss-coder-publicises-government-spy-trojan/
   |archive-date=26 January 2014
   |date=27 August 2009
   |url-status=dead}}{{cbignore|bot=InternetArchiveBot}}</ref> and the [[Staatstrojaner|German "state trojan" nicknamed R2D2]].<ref name="cupa"/> German govware works by exploiting security gaps unknown to the general public and accessing smartphone data before it becomes encrypted via other applications.<ref>{{Cite web
   |title = German federal police use trojan virus to evade phone encryption
   |url = http://www.dw.com/en/german-federal-police-use-trojan-virus-to-evade-phone-encryption/a-42328466
   |website = [[Deutsche Welle|DW]]
   |access-date = 2018-04-14}}</ref>

Due to the popularity of [[Botnet|botnets]] among hackers and the availability of advertising services that permit authors to violate their users' privacy, trojans are becoming more common. According to a survey conducted by [[Bitdefender|BitDefender]] from January to June 2009, "Trojan-type malware is on the rise, accounting for 83% of the global malware detected in the world." trojans have a relationship with worms, as they spread with the help given by worms and travel across the internet with them.<ref name="Bitdefender2009"/> BitDefender has stated that approximately 15% of computers are members of a botnet, usually recruited by a trojan infection.<ref name="Datta2014"/>

Recent investigations have revealed that the trojan-horse method has been used as an attack on [[cloud computing]] systems. A trojan attack on cloud systems tries to insert an application or service into the system that can impact the cloud services by changing or stopping the functionalities. When the cloud system identifies the attacks as legitimate, the service or application is performed which can damage and infect the cloud system.<ref>{{Cite journal |last1=Kanaker |first1=Hasan |last2=Karim |first2=Nader Abdel |last3=Awwad |first3=Samer A. B. |last4=Ismail |first4=Nurul H. A. |last5=Zraqou |first5=Jamal |last6=Ali |first6=Abdulla M. F. Al |date=2022-12-20 |title=Trojan Horse Infection Detection in Cloud Based Environment Using Machine Learning |url=https://online-journals.org/index.php/i-jim/article/view/35763 |journal=International Journal of Interactive Mobile Technologies |language=en |volume=16 |issue=24 |pages=81–106 |doi=10.3991/ijim.v16i24.35763 |issn=1865-7923|doi-access=free }}</ref>