Threats · 112 days ago
The hard part here is not the loader chain. It is that Lazarus can land a full RAT without leaving the final payload on disk, so a normal filesystem hunt can miss the compromise entirely and the intrusion can stay quiet for longer than disk-based triage expects.
Researchers tied RemotePE to Lazarus activity against financial and cryptocurrency organizations. Fox-IT says DPAPILoader uses Windows DPAPI to decrypt the next stage from disk, then RemotePELoader pulls in RemotePE and runs it entirely in memory, leaving no filesystem artifacts. The group has already used employee-targeted social engineering to reach victims in this track, so chat impersonation and fake meeting links remain a practical entry path.
That makes the compromise harder to prove after the fact. If the host is your main source of evidence, the final stage may already be gone from the places you expect to find it.
1 source covering this story
Lazarus Deploys RemotePE Memory-Only RAT Against Financial and Crypto Firms
Lazarus deployed RemotePE against crypto firms using memory-only malware, enabling stealthy long-term financial intrusions.
Part of the PlainSec briefing for 2026-05-25