# Lazarus Group's RemotePE: A Stealthy Memory-Only RAT Targeting Financial and Crypto Organizations


North Korea-linked Lazarus Group has deployed a sophisticated remote access trojan called RemotePE in targeted attacks against financial and cryptocurrency firms, according to new research from NCC Group subsidiary Fox-IT. The malware represents a significant evolution in the threat actor's arsenal, combining memory-only execution with advanced evasion techniques to avoid detection while maintaining persistent, stealthy access to high-value targets.


## The Threat


RemotePE is a cross-platform remote access trojan that operates entirely in memory, never touching the disk and leaving minimal forensic artifacts. The malware is the final payload in a multi-stage attack chain that begins with social engineering and progresses through sophisticated loading mechanisms designed to evade modern endpoint detection and response (EDR) tools.


According to Fox-IT researchers Yun Zheng Hu and Mick Koomen, the attack sequence involves two custom loaders:


  • DPAPILoader — decrypts and loads RemotePELoader from disk using the Windows Data Protection API (DPAPI)
  • RemotePELoader — beacons to a command-and-control (C2) server and waits for the final payload

  • The full infection chain remains difficult to detect because each stage is designed to minimize forensic footprint and avoid triggering security alerts. The earliest DPAPILoader artifact dates back to November 2023, indicating the toolset has been under active development and refinement for over two years.


    ## Background and Context


    Lazarus Group has long demonstrated a focused interest in financial institutions and cryptocurrency organizations, conducting high-impact operations for espionage, data theft, and financial fraud. RemotePE fits squarely within this operational pattern—a purpose-built tool for maintaining quiet, long-term access to high-value targets before executing a final objective.


    Fox-IT first identified RemotePE in September 2025 following an attack on an unnamed decentralized finance (DeFi) organization. The initial compromise vector was notably low-tech: a Lazarus operator posed as an employee of a trading company on Telegram, building rapport with a target employee, and scheduling a meeting using fake Calendly and Picktime domains. This social engineering approach led to the victim downloading and executing malicious files, beginning the infection chain.


    The same intrusion resulted in the deployment of three malware families: PondRAT, ThemeForestRAT, and RemotePE. This multi-malware approach suggests Lazarus was establishing redundancy and ensuring persistent access through multiple mechanisms—a hallmark of operations designed for long-term observation campaigns.


    ## Technical Details


    ### Attack Chain Architecture


    The three-stage attack sequence is deliberately engineered to maintain low visibility:


    1. Stage One (DPAPILoader) — The initial DLL ("Iassvc.dll") uses Windows DPAPI to decrypt and load an encrypted payload stored on disk. DPAPI uses the user's credentials and Windows architecture to encrypt sensitive data, making the encrypted file visible but unreadable without the target account's security context.


    2. Stage Two (RemotePELoader) — The decrypted loader contacts a remote C2 server ("aes-secure[.]net") over HTTP and retrieves the final payload. Before execution, RemotePELoader deploys multiple evasion techniques:

    - Hell's Gate — bypasses API hooking by enumerating system call numbers dynamically

    - ETW patching — disables Event Tracing for Windows, preventing logged API calls from reaching security monitoring tools


    3. Stage Three (RemotePE) — A fully-featured RAT written in C++ that polls the C2 server for commands and maintains active callback communications.


    ### Malware Capabilities


    RemotePE supports six primary command categories:


    | Category | Function |

    |----------|----------|

    | Configuration | Obtain or modify C2 settings |

    | File System | Change working directory, manage files, delete with secure overwriting |

    | Module Management | Register, list, or unload DLL modules |

    | Process Control | List processes, create new processes, or terminate by process ID |

    | Operational | Sleep for specified intervals or exit the RAT |

    | Connectivity | Ping the C2 server for keepalive |


    A particularly notable feature is the secure file deletion routine, which overwrites each file with constant bytes seven times before renaming and deleting it. This pattern has also been observed in PondRAT and POOLRAT (also known as SIMPLESEA), suggesting code reuse or shared development practices within Lazarus subgroups.


    ### Detection Evasion


    RemotePE was specifically engineered for stealth. Analysis of four recovered samples shows active development between mid-2023 and mid-2024, with the first compilation timestamp dating to July 4, 2023. Critically, neither RemotePELoader nor RemotePE appeared on VirusTotal before Fox-IT's publication, indicating the toolset was exclusively reserved for high-value, targeted operations rather than mass-market attacks.


    The malware's reliance on in-memory execution, environmental keying, and EDR evasion techniques ensures it leaves minimal evidence for forensic analysis. The use of legitimate DPAPI for encryption means the encrypted payload blends with normal Windows functionality, and the ETW patching prevents detailed logging of API calls that might reveal malicious activity.


    ## Implications for Organizations


    The emergence of RemotePE presents several critical implications:


    Detection Difficulty — Traditional file-scanning approaches are ineffective against memory-only malware. Organizations relying solely on endpoint protection platforms (EPPs) that focus on disk-based signatures are unlikely to detect RemotePE before C2 communication begins.


    Financial Sector Targeting — Lazarus's continued focus on financial and cryptocurrency organizations indicates no diminishment in this threat actor's commitment to the sector. Crypto exchanges, DeFi protocols, and investment firms should treat this as a direct threat.


    Supply Chain and Credential Compromise — The social engineering vector—impersonation via Telegram—is disturbingly simple yet effective. The threat actor invested time building rapport and creating convincing false domains (Calendly and Picktime lookalikes), suggesting a patient, human-directed approach rather than automated phishing campaigns.


    Long-Term Access Model — The "actor-in-the-loop" delivery mechanism and toolset design suggest Lazarus prioritizes establishing persistent access before executing high-impact operations. Organizations may be compromised and observed for weeks or months before data theft or financial fraud occurs.


    ## Recommendations


    Organizations at risk should consider the following defensive measures:


  • EDR and Network Monitoring — Deploy advanced EDR solutions that monitor behavioral indicators, memory injection patterns, and suspicious system call sequences, not just file creation. Monitor outbound HTTP traffic for beacon activity, particularly to suspicious domains.

  • DPAPI Usage Audit — Review and restrict which applications can use DPAPI. Consider deploying policies that alert on suspicious DPAPI decryption operations, particularly those involving service accounts or batch processes.

  • ETW Monitoring — Implement detection for ETW patching attempts. Monitor for modifications to ETW configuration and alert on suspicious attempts to disable Windows event logging.

  • Social Engineering Training — Conduct targeted security awareness training emphasizing the specific tactics observed in this campaign: impersonation via messaging platforms, fake scheduling domains, and rapport-building over time.

  • C2 Domain Monitoring — Maintain updated threat intelligence feeds of known Lazarus C2 domains and IP addresses. Block identified C2 infrastructure at the network perimeter and monitor for any callback attempts.

  • Code Signing Enforcement — Enforce strict code-signing policies to prevent unsigned or dubiously-signed DLLs from loading into sensitive processes.

  • ---


    ## HackWire Analysis


    RemotePE exemplifies a troubling convergence in modern malware design: off-the-shelf evasion techniques (Hell's Gate, ETW patching) combined with patient, human-directed operations. What makes this campaign particularly dangerous is not the novelty of any single component—these evasion methods are now commoditized—but rather Lazarus's demonstrated willingness to invest time and human oversight in campaigns against specific high-value targets.


    The social engineering entry point deserves special attention. Lazarus created fake scheduling domains and conducted what amounts to a mini-recruitment impersonation campaign over Telegram. This is the opposite of spray-and-pray phishing; it's targeted, relationship-based compromise. For defenders, this highlights a painful truth: no amount of technical controls prevent an employee from being socially engineered. The real question becomes: how quickly can you detect a compromised employee's device before the attack chain progresses?


    Equally significant is that both RemotePELoader and RemotePE remained undetected on VirusTotal—a signal that Lazarus is maintaining operational discipline and reserving these tools for high-value targets rather than widespread distribution. This pattern contrasts sharply with commodity malware and suggests the threat actor is managing its toolkit strategically. For financial and crypto organizations, this is a reminder that you may be on Lazarus's target list even if you're not industry-leading—the group targets broadly across the sector and maintains persistent access for months before executing impact.


    Organizations should treat RemotePE as a wake-up call that EDR solutions detecting only file-based signatures and behavioral patterns may miss entirely—the RAT operates entirely in memory and uses Windows APIs in ways that are syntactically legitimate, even if semantically malicious. The defensive shift required is toward memory forensics, API call auditing, and C2 communication detection rather than relying on endpoint tools to block a file from executing.


    — HackWire Editorial


    ## Related Coverage


  • Read more in our [Malware](https://www.hackwire.news/category/malware) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)