# Lazarus Group's RemotePE: A Stealthy Memory-Only RAT Targeting Financial and Crypto Organizations
North Korea-linked Lazarus Group has deployed a sophisticated remote access trojan called RemotePE in targeted attacks against financial and cryptocurrency firms, according to new research from NCC Group subsidiary Fox-IT. The malware represents a significant evolution in the threat actor's arsenal, combining memory-only execution with advanced evasion techniques to avoid detection while maintaining persistent, stealthy access to high-value targets.
## The Threat
RemotePE is a cross-platform remote access trojan that operates entirely in memory, never touching the disk and leaving minimal forensic artifacts. The malware is the final payload in a multi-stage attack chain that begins with social engineering and progresses through sophisticated loading mechanisms designed to evade modern endpoint detection and response (EDR) tools.
According to Fox-IT researchers Yun Zheng Hu and Mick Koomen, the attack sequence involves two custom loaders:
The full infection chain remains difficult to detect because each stage is designed to minimize forensic footprint and avoid triggering security alerts. The earliest DPAPILoader artifact dates back to November 2023, indicating the toolset has been under active development and refinement for over two years.
## Background and Context
Lazarus Group has long demonstrated a focused interest in financial institutions and cryptocurrency organizations, conducting high-impact operations for espionage, data theft, and financial fraud. RemotePE fits squarely within this operational pattern—a purpose-built tool for maintaining quiet, long-term access to high-value targets before executing a final objective.
Fox-IT first identified RemotePE in September 2025 following an attack on an unnamed decentralized finance (DeFi) organization. The initial compromise vector was notably low-tech: a Lazarus operator posed as an employee of a trading company on Telegram, building rapport with a target employee, and scheduling a meeting using fake Calendly and Picktime domains. This social engineering approach led to the victim downloading and executing malicious files, beginning the infection chain.
The same intrusion resulted in the deployment of three malware families: PondRAT, ThemeForestRAT, and RemotePE. This multi-malware approach suggests Lazarus was establishing redundancy and ensuring persistent access through multiple mechanisms—a hallmark of operations designed for long-term observation campaigns.
## Technical Details
### Attack Chain Architecture
The three-stage attack sequence is deliberately engineered to maintain low visibility:
1. Stage One (DPAPILoader) — The initial DLL ("Iassvc.dll") uses Windows DPAPI to decrypt and load an encrypted payload stored on disk. DPAPI uses the user's credentials and Windows architecture to encrypt sensitive data, making the encrypted file visible but unreadable without the target account's security context.
2. Stage Two (RemotePELoader) — The decrypted loader contacts a remote C2 server ("aes-secure[.]net") over HTTP and retrieves the final payload. Before execution, RemotePELoader deploys multiple evasion techniques:
- Hell's Gate — bypasses API hooking by enumerating system call numbers dynamically
- ETW patching — disables Event Tracing for Windows, preventing logged API calls from reaching security monitoring tools
3. Stage Three (RemotePE) — A fully-featured RAT written in C++ that polls the C2 server for commands and maintains active callback communications.
### Malware Capabilities
RemotePE supports six primary command categories:
| Category | Function |
|----------|----------|
| Configuration | Obtain or modify C2 settings |
| File System | Change working directory, manage files, delete with secure overwriting |
| Module Management | Register, list, or unload DLL modules |
| Process Control | List processes, create new processes, or terminate by process ID |
| Operational | Sleep for specified intervals or exit the RAT |
| Connectivity | Ping the C2 server for keepalive |
A particularly notable feature is the secure file deletion routine, which overwrites each file with constant bytes seven times before renaming and deleting it. This pattern has also been observed in PondRAT and POOLRAT (also known as SIMPLESEA), suggesting code reuse or shared development practices within Lazarus subgroups.
### Detection Evasion
RemotePE was specifically engineered for stealth. Analysis of four recovered samples shows active development between mid-2023 and mid-2024, with the first compilation timestamp dating to July 4, 2023. Critically, neither RemotePELoader nor RemotePE appeared on VirusTotal before Fox-IT's publication, indicating the toolset was exclusively reserved for high-value, targeted operations rather than mass-market attacks.
The malware's reliance on in-memory execution, environmental keying, and EDR evasion techniques ensures it leaves minimal evidence for forensic analysis. The use of legitimate DPAPI for encryption means the encrypted payload blends with normal Windows functionality, and the ETW patching prevents detailed logging of API calls that might reveal malicious activity.
## Implications for Organizations
The emergence of RemotePE presents several critical implications:
Detection Difficulty — Traditional file-scanning approaches are ineffective against memory-only malware. Organizations relying solely on endpoint protection platforms (EPPs) that focus on disk-based signatures are unlikely to detect RemotePE before C2 communication begins.
Financial Sector Targeting — Lazarus's continued focus on financial and cryptocurrency organizations indicates no diminishment in this threat actor's commitment to the sector. Crypto exchanges, DeFi protocols, and investment firms should treat this as a direct threat.
Supply Chain and Credential Compromise — The social engineering vector—impersonation via Telegram—is disturbingly simple yet effective. The threat actor invested time building rapport and creating convincing false domains (Calendly and Picktime lookalikes), suggesting a patient, human-directed approach rather than automated phishing campaigns.
Long-Term Access Model — The "actor-in-the-loop" delivery mechanism and toolset design suggest Lazarus prioritizes establishing persistent access before executing high-impact operations. Organizations may be compromised and observed for weeks or months before data theft or financial fraud occurs.
## Recommendations
Organizations at risk should consider the following defensive measures:
---
## HackWire Analysis
RemotePE exemplifies a troubling convergence in modern malware design: off-the-shelf evasion techniques (Hell's Gate, ETW patching) combined with patient, human-directed operations. What makes this campaign particularly dangerous is not the novelty of any single component—these evasion methods are now commoditized—but rather Lazarus's demonstrated willingness to invest time and human oversight in campaigns against specific high-value targets.
The social engineering entry point deserves special attention. Lazarus created fake scheduling domains and conducted what amounts to a mini-recruitment impersonation campaign over Telegram. This is the opposite of spray-and-pray phishing; it's targeted, relationship-based compromise. For defenders, this highlights a painful truth: no amount of technical controls prevent an employee from being socially engineered. The real question becomes: how quickly can you detect a compromised employee's device before the attack chain progresses?
Equally significant is that both RemotePELoader and RemotePE remained undetected on VirusTotal—a signal that Lazarus is maintaining operational discipline and reserving these tools for high-value targets rather than widespread distribution. This pattern contrasts sharply with commodity malware and suggests the threat actor is managing its toolkit strategically. For financial and crypto organizations, this is a reminder that you may be on Lazarus's target list even if you're not industry-leading—the group targets broadly across the sector and maintains persistent access for months before executing impact.
Organizations should treat RemotePE as a wake-up call that EDR solutions detecting only file-based signatures and behavioral patterns may miss entirely—the RAT operates entirely in memory and uses Windows APIs in ways that are syntactically legitimate, even if semantically malicious. The defensive shift required is toward memory forensics, API call auditing, and C2 communication detection rather than relying on endpoint tools to block a file from executing.
— HackWire Editorial
## Related Coverage