Post-compromise malware is malware built to run after an attacker has already gained an initial foothold. Its main goals are persistence, stealthy control, and follow-on activity such as credential theft, lateral movement, data collection, or preparing later payloads. Unlike dropper malware that mainly focuses on breaking in, post-compromise tools are designed to stay useful inside a breached environment.
This matters because defenders must look beyond the first intrusion. Post-compromise malware often uses trusted software, service creation, DLL sideloading, scheduled tasks, or encrypted command-and-control channels to blend in with normal activity. In practice, security teams hunt for unusual parent-child process chains, unexpected library loads, suspicious outbound connections, and recurring persistence mechanisms. The key defensive idea is simple: once access is achieved, the real threat may be the software that quietly turns a short breach into a long-lived intrusion.