Memory-born malware is already inside your pc and antivirus can't see it
Forget the hooded hacker dropping a suspicious .exe on your desktop. The new strain stalking corporate networks this week never touches the disk at all; it lives, breeds and pillages entirely inside RAM, then vanishes the moment you reboot. Security teams call it fileless, a name that sounds like a gimmick until you realise it has already emptied dozens of bank accounts from London to Singapore without triggering a single red flag.
The ghost in the ram
The trick is insultingly simple: instead of planting foreign code, attackers hijack tools Windows ships with. A one-line PowerShell command, a scrap of JavaScript in the registry, a scheduled task that calls werfault.exe—all legitimate, all whitelisted. Once the payload is running in memory it phones home, dumps credentials, even moves laterally to domain controllers, all while your endpoint agent hums along convinced nothing malicious ever landed.
Proofpoint logged a 1,300 % spike in such campaigns since January. CrowdStrike says the average dwell time inside a victim now exceeds 112 days, triple that of conventional ransomware. By the time a SOC analyst spots the anomaly—usually a lateral-movement query that shouldn’t exist—the intruder has already cashed out.
Where antivirus looks the other way
Traditional scanners rely on hashes, file signatures and static indicators. Strip the file away and the hash disappears; live only in volatile memory and the signature never forms. Microsoft Defender can flag obfuscated PowerShell, sure, but only if the command is longer than 200 characters or matches a published pattern. Trim it, encode it, split it across three registry keys and the alarm stays quiet.
Worse, attackers now chain living-off-the-land binaries—LOLbins in industry slang—to erase their own footprints. One recent sample used certutil to decode a payload stashed in a fake certificate, executed it via mshta, then overwrote the memory space with zeroes. Forensics arrived to a pristine workstation that had, moments earlier, siphoned a customer database worth €40 million.
Behaviour is the new fingerprint
Security vendors are racing to rewrite the rulebook. Palo Alto, SentinelOne and Cybereason now train models on process ancestry: which parent spawns which child, how often, in what sequence. A PowerShell that spawns rundll32 that calls the registry that edits WMI filters? That genealogy screams louder than any hash.
Yet the fix demands more than another licence fee. Gartner estimates that 70 % of midsize firms still run Windows 7 on at least one critical host—an OS whose built-in logging can’t even capture the required telemetry. Even on Windows 11, memory telemetry is off by default; turning it on can add 8 % CPU overhead, enough for CFOs to balk. Security teams are left bargaining for performance with their own infrastructure.
The boardroom finally listens
Regulators are losing patience. The coming NIS2 directive in Europe will fine companies up to 2 % of global turnover if they can’t prove they detected an intrusion within 24 hours. Try explaining to Brussels that the malware never existed on disk and your logs rotate every 12. Insurers are already inserting fileless exclusion clauses; some refuse to cover losses tied to PowerShell abuse altogether.
So the race narrows to milliseconds: can your EDR spot the micro-thread before it dispatches the vault credentials? Can your SOC triage a process chain that looks identical to a sysadmin pushing updates? The cruel answer, according to Mandiant’s latest M-Trends, is no—at least not without human hunters who know what normal smells like on their own network.
Meanwhile the attackers aren’t resting. GitHub now hosts polished frameworks—SharpSploit, PowerLess—that wrap fileless techniques into copy-paste modules. A teenager with a grudge and a weekend can replicate what once required nation-state tooling. Memory is the new filesystem, and we handed over the keys years ago.
The takeaway is blunt: if your 2024 budget still allocates 90 % of security spend to perimeter firewalls and email gateways, you’re guarding the door while the thief already lounges on your sofa, sipping RAM and flipping through your crown jewels. Rip up the spreadsheet, turn on verbose PowerShell logging, vet every scheduled task—and pray the next breach doesn’t pick your firm as the tutorial video.