Memory-only is a tradecraft pattern where malware or attacker activity runs in RAM instead of leaving obvious files on disk. Attackers use it to reduce traditional artifacts such as dropped executables, scripts, or web shells stored in the filesystem. The code may be injected into an existing process, loaded from a network response, or executed in a temporary in-memory container.
This matters because many defensive controls focus on file scanning and disk forensics. A memory-only foothold can be harder to detect and may disappear on reboot, while still enabling command execution, credential theft, or lateral movement. Defenders usually need to look at process behavior, memory snapshots, network connections, logs, and configuration changes. In edge-device compromises, a memory-only web shell or payload can turn a trusted appliance into a stealthy access point without leaving the usual on-disk traces.