Lazarus Deploys RemotePE Memory-Only RAT Against Financial and Crypto Firms

RemotePE is a memory-only RAT deployed by Lazarus Group against financial and cryptocurrency organizations.

• •Three-stage infection uses DPAPILoader to decrypt RemotePELoader, executing RemotePE entirely in memory without disk artifacts
• •Social engineering on Telegram with fake Calendly and Picktime domains used for initial access
• •Employs Hell's Gate and Event Tracing for Windows (ETW) patching for evasion
• •Supports command categories for C2 configuration, file operations, process management, and server communication
• •Active development from July 2023 to mid-2024 with zero VirusTotal detections before disclosure, purpose-built for high-value long-term observation

This summary was automatically generated by AI based on the original article and may not be fully accurate.