Memory-Only Lazarus RAT Hides Financial Intrusions
The hard part here is not the loader chain. It is that Lazarus can land a full RAT without leaving the final payload on disk, so a normal filesystem hunt can miss the compromise entirely and the intrusion can stay quiet for longer than disk-based triage expects.
Researchers tied RemotePE to Lazarus activity against financial and cryptocurrency organizations. Fox-IT says DPAPILoader uses Windows DPAPI to decrypt the next stage from disk, then RemotePELoader pulls in RemotePE and runs it entirely in memory, leaving no filesystem artifacts. The group has already used employee-targeted social engineering to reach victims in this track, so chat impersonation and fake meeting links remain a practical entry path.
That makes the compromise harder to prove after the fact. If the host is your main source of evidence, the final stage may already be gone from the places you expect to find it.