12 years ago I took “Malicious Software and its Underground Economy: Two Sides to Every Story” and it was quite interesting not so much for the technical aspect (which was still nice) but for the economical aspect that is often underappreciated. The core idea was that scammers or hackers might be doing it for fun, as you did, or learning, as I did… but the ones who keep on doing it sustainably make money out of it, consequently they are predictable. Namely they need repeatable methods that scale or that target a specific group. I really recommend taking a similar class but anyway, the big picture here is sure, maybe AV would miss such things and yet it wouldn’t really matter because nearly nobody does that and/or it wouldn’t propagate much.
Thanks, it’s quite interesting but again IMHO it relies on bad practices. If you’ve been compromised and you “restore” (not in an sandboxed environment dedicated to study the threat) then you are asking for trouble. I’ll read a bit more in depth but the timeline I see 1987, 1998, 2017 show me this is a very very niche strategy, to the point that it’s basically irrelevant. Again it’s good to know of it, conceptually, but in practice proper backups (namely of data) remains in my eyes the best way to mitigate most problems, attacks and just back luck (failing hardware, fire, etc) alike.