A senior incident response manager receives a call about some external IPs communicating with internal computers during off hours. Which of the following types of malware is MOST likely causing this…

A botnet involves compromised computers (bots) connecting to a command-and-control (C2) server, often operated by external IPs, to receive instructions and exfiltrate data. This communication frequently occurs during off-hours to evade detection, fitting the scenario perfectly.

Ransomware's primary characteristic is encrypting data and demanding a ransom payment, not persistent outbound communication with external IPs during off-hours for control purposes.

Polymorphic malware refers to malware that changes its code to evade signature-based detection, which describes a characteristic of malware, not its observed communication behavior.

An armored virus employs techniques to make reverse engineering and analysis difficult, which is a method of protection for the malware, not its external communication pattern.