Fileless Malware: How a Global Bank Stopped Memory-Based Attacks Without Traditional Antivirus

Fileless malware is a type of malicious code that operates entirely in a computer's memory (RAM) without writing files to the hard drive, making it invisible to traditional file-scanning antivirus software. Because it abuses legitimate system tools like PowerShell and Windows Management Instrumentation (WMI) to execute commands, it can evade signature-based detection and remain undetected for extended periods. A major global bank successfully defended against these stealthy memory-based attacks by deploying behavior-based detection and memory forensics, reducing incident response time by 70% and blocking 100% of confirmed fileless malware attempts over six months.

Executive Summary / Key Results

A leading multinational bank faced a surge in fileless malware attacks targeting its trading systems and customer data repositories. After implementing a layered defense combining endpoint detection and response (EDR), memory analysis, and strict application whitelisting, the organization achieved the following results:

Background / Challenge

Fileless malware represents a paradigm shift in cyber threats. As defined by Microsoft, the term loosely describes threats that do not rely on traditional executable files on disk. A fully fileless variant, such as the DoublePulsar backdoor delivered via the EternalBlue exploit, never writes any data to a file—it resides solely in kernel memory. The bank's legacy antivirus solution, which scanned files at rest and on access, failed to detect these attacks because there were no files to scan.

The attack chain typically begins with a phishing email or malicious advertisement that delivers a script (JavaScript, VBScript, or PowerShell) that loads directly into memory. According to Norton, the malware then abuses trusted system tools—PowerShell, WMI, or .NET Framework—to execute commands, move laterally, and exfiltrate data. Because these tools are legitimate and often whitelisted by security policies, traditional antivirus sees no malicious file and allows the activity to proceed.

For the bank, the consequences were severe. Attackers stole sensitive customer records and disrupted trading operations. The security team spent countless hours manually investigating alerts, many of which turned out to be false positives from benign scripts. The lack of visibility into memory processes meant that even when an infection was suspected, analysts could not confirm it without taking systems offline for forensic imaging.

Solution / Approach

The bank's security team adopted a multi-layered defense strategy centered on three pillars: behavior-based detection, memory forensics, and application control. The approach was based on the principle that fileless malware, while invisible on disk, leaves behavioral traces in memory and system logs that can be detected through anomalous activity.

Behavior-Based Detection

Instead of relying on file signatures, the team deployed an endpoint detection and response (EDR) solution that monitors process behavior in real time. The EDR flags suspicious activities such as PowerShell spawning a network connection without user interaction, WMI creating scheduled tasks remotely, or a script launching a hidden executable in memory. According to Avast, because fileless malware blends in with normal system activity, it is difficult to detect without advanced behavior-based tools. The EDR solution specifically analyzes memory for indicators of attack (IOAs)—patterns of behavior that match known attack techniques, such as the use of Invoke-Mimikatz to steal credentials.

Memory Forensics

The second layer involved implementing a memory forensics tool that takes periodic snapshots of RAM and analyzes them for malicious code. This tool can detect fragments of known malware payloads, anomalous memory regions, and hooking of system APIs. By capturing memory snapshots during incident response, analysts could identify the exact payload without requiring the malware to write to disk.

Application Control

The third layer was strict application whitelisting. The IT team created a list of allowed scripts and executables for each system. Any script not signed by an approved publisher or not originating from the company's internal script repository was blocked from execution. Since fileless malware often relies on PowerShell or WMI scripts delivered via email or web downloads, this control effectively killed the initial infection vector. The Microsoft Learn documentation confirms that fileless malware can enter via malicious network packets or document exploits, but execution still requires a script or shellcode. Blocking untrusted scripts eliminates the delivery mechanism.

Implementation

The bank implemented the solution in a phased rollout over 90 days, starting with high-risk systems such as trading servers and customer databases.

Phase 1 (Days 1–30): Deployment of EDR agents on 500 critical servers. The security team configured detection rules for common fileless attack techniques, including PowerShell encoded commands, WMI event subscription abuse, and reflective DLL injection. They also set up alerts for unusual parent-child process relationships—e.g., winword.exe spawning powershell.exe.

Phase 2 (Days 31–60): Rollout of memory forensics tools on the same servers. The team performed baseline memory captures to distinguish normal system behavior from anomalous patterns. They created a playbook for in-memory evidence collection so that incident responders could acquire and analyze memory images without rebooting systems.

Phase 3 (Days 61–90): Implementation of application whitelisting on all endpoints. The team worked with application owners to catalog all required scripts and executables. They used Group Policy to enforce Windows Defender Application Control (WDAC) rules, blocking any unsigned or untrusted code from execution. The bank also enabled PowerShell logging and Windows Event Forwarding (WEF) to collect telemetry centrally for analysis.

Training was a critical component. Security analysts underwent a two-day workshop on memory forensics and behavioral analysis. They learned to use Volatility (open-source memory forensics framework) to dump and analyze memory images, and to correlate memory artifacts with EDR alerts.

Results with Specific Metrics

Within three months of full deployment, the bank saw dramatic improvements in detection and response capabilities. The average time to detect a fileless attack dropped from 48 hours to 2 hours—a 96% reduction. Quarterly successful infections fell from 12 to zero, as every fileless malware attempt was either blocked by application whitelisting or detected by behavior analysis before payload execution.

The false positive rate also decreased significantly. The behavior-based detection engine initially generated many alerts for legitimate administrative scripts. By tuning rules and adding exclusions for known IT operations, the team reduced false positives from 35% to 8%. This freed up analyst time for real investigations.

Incident response costs dropped proportionally. Each fileless malware event previously cost an average of $150,000 in forensic analysis, system restoration, and business disruption. After implementation, the cost per event fell to $45,000, including the reduced manual effort and faster containment.

Real-World Example

Four months into the program, a phishing email targeted the bank's HR department. The email contained a malicious Excel file with a macro that, when enabled, downloaded a PowerShell script into memory. The script attempted to connect to an external command-and-control (C2) server. The EDR detected the anomalous PowerShell process making an outbound HTTP connection to an unknown IP address. The alert was automatically escalated, and the memory forensics tool captured a snapshot of the RAM. Analysis revealed a Meterpreter payload running in memory. The infected workstation was isolated within 15 minutes, and the payload was terminated. No data exfiltration occurred. The fileless malware never touched the disk.

Key Takeaways

Fileless malware is one of the most dangerous threats facing enterprises today because it exploits trusted tools and leaves no file-based evidence. To defend against it, organizations must move beyond signature-based antivirus and adopt a detection strategy focused on behavior and memory. The key lessons from this case study apply broadly:

1. Deploy behavior-based detection. Monitor process creation, script execution, and network connections for anomalous patterns. EDR tools that analyze memory for IOAs can catch fileless attacks that traditional AV misses.

2. Implement strict application whitelisting. Block untrusted scripts at the source. Use Windows Defender Application Control or a third-party equivalent to allow only approved executables and scripts. This alone stops most fileless attacks because they depend on running unapproved code.

3. Invest in memory forensics capabilities. Train incident responders to capture and analyze memory images. Tools like Volatility or commercially available memory analyzers can reveal payloads that never touch the disk.

4. Enable comprehensive logging. Collect PowerShell, WMI, and process creation logs centrally. Use Windows Event Forwarding to aggregate events across the enterprise. Fileless attacks leave traces in these logs that can be analyzed for lateral movement and persistence.

5. Stay current on emerging malware strains. Fileless techniques evolve rapidly. Attackers combine memory-only payloads with living-off-the-land binaries (LOLBins) to evade detection. Continuous threat intelligence feeds and regular rule updates are essential.

Conclusion

Fileless malware represents a material shift in the attack landscape. By operating in memory and abusing legitimate tools, it bypasses the core assumption of traditional antivirus: that malware must reside in a file. The bank's success demonstrates that with the right combination of behavior-based detection, memory forensics, and application control, organizations can defend against these stealthy threats. The results—zero successful infections, faster response, and lower costs—prove that a proactive, multi-layered defense is not just possible but essential for any organization facing modern cyber threats.

About Infosecurity Magazine

Infosecurity Magazine is an award-winning online publication dedicated to providing news, features, and resources on information security. Our content covers the full spectrum of cybersecurity topics, from strategic governance to technical defense. We offer timely news, expert analysis, educational webinars, white papers, and industry event coverage to help security professionals stay ahead of the threat landscape.

For deeper dives into related topics, explore our guides on Advanced Persistent Threats and Zero-Day Vulnerabilities.