Lazarus Group Deploys RemotePE Memory-Only RAT Against Crypto and Financial Firms; $577M Stolen YTD

Fox-IT (NCC Group) researchers Yun Zheng Hu and Mick Koomen disclosed that the North Korea-linked Lazarus Group is actively deploying RemotePE, a fully fileless RAT that executes entirely in memory via a three-stage chain using DPAPILoader, RemotePELoader, and Hell's Gate/ETW-patching techniques — leaving zero filesystem artifacts and evading EDR. Initial access begins with Telegram-based social engineering where operators impersonate trading firm employees and lure targets through fake Calendly and Picktime scheduling domains. Neither RemotePELoader nor RemotePE appeared on VirusTotal prior to publication, suggesting the toolset is reserved for high-value targets; Lazarus has stolen approximately $577M in crypto in the first four months of 2026 alone, accounting for 76% of all global crypto theft.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the critical severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.