MYRA RAT Fileless Execution via memfd_create and fexecve (T1027.011)

Ethan Andrews@eandrews

•updated Jun 22, 2026•0•0•2

Detects MYRA RAT fileless execution where memfd_loader or memfd_exec loads the Node.js binary and JavaScript agent bundle into anonymous memory file descriptors via memfd_create and executes via fexecve. Resulting processes show /proc/PID/exe pointing to '/memfd:.node (deleted)' or '/memfd:.bundle' with no files on disk.