BOF loading is the process of running a Beacon Object File, or BOF, inside an already compromised process. A BOF is a small, modular payload built to perform one task at a time, such as listing processes, querying hosts, or running reconnaissance commands, without dropping a separate full-featured tool on disk.
This matters in cyber security because it gives attackers flexible post-exploitation capability while reducing obvious file-based artifacts. Instead of rebuilding a whole implant, an operator can load new functionality into memory as needed and keep activity focused inside a trusted process. Defenders look for signs of in-memory execution, unusual thread or memory behavior, and process activity that does not match the normal role of the host application. BOF loading is common in advanced intrusions because it helps attackers stay modular, stealthy, and adaptable.