Researchers warn of fileless payloads, memory hooks, and a UDP-based C2 controller that complicate detection and remediation.