Fileless malware campaign roundup

This Zscaler ThreatLabZ report examines an increase in fileless infection chains that leverage legitimate Windows utilities and document exploits to load malware directly into memory—highlighting three cases: njRat (backdoor) delivered via DOCX→RTF→VBA→PowerShell, Sodinokibi/REvil (ransomware) loaded from Base64 PowerShell in a BAT→pastebin chain, and Astaroth (credential-stealing trojan) using LNK→WMIC→XSL→Bitsadmin/Certutil/Regsvr32. The report emphasizes detection challenges, provides example IOCs (download URLs and a C2 domain), and explains how these tactics avoid disk artifacts.