Lazarus' RemotePE Lives Entirely in Memory, Targets Crypto Treasuries
A fresh in-memory RAT from DPRK's Lazarus Group is being chained behind two custom loaders to drain finance and crypto orgs. Here is what to check tonight.
If you run a treasury desk or a crypto exchange backend, this one is aimed at you. Researchers at Fox-IT, the NCC Group subsidiary, have detailed a memory-only remote access trojan called RemotePE that the North Korea-linked Lazarus Group is deploying against financial and cryptocurrency firms. The malware never touches disk on the final stage, which is the whole point.
The chain has three pieces. A first-stage loader called DPAPILoader decrypts and runs a second loader, RemotePELoader, which in turn pulls down and executes RemotePE entirely in memory. Fox-IT describes RemotePE as cross-platform and notes the Lazarus operators reserve it for higher-value targets after initial triage with noisier tooling.
The DPAPI part matters. DPAPILoader abuses Windows' Data Protection API to tie payload decryption to the compromised host, so if your IR analyst grabs the loader and runs it in a sandbox on a different machine, it will not decrypt. That kills a lot of standard triage workflows. You will need live-host memory acquisition, not the usual "pull the binary and detonate it elsewhere" routine.
This fits Lazarus' pattern over the past two years. The group (tracked variously as APT38 and TraderTraitor for its crypto-focused subcluster) has pulled off some of the largest digital asset thefts on record, including the $1.5 billion Bybit incident in February. Job-lure social engineering on LinkedIn and fake recruiter Zoom calls remain the favoured initial access path.
And the targeting is deliberate. Lazarus is not spraying RemotePE at everyone. It is appearing on hosts belonging to developers, sysadmins, and treasury staff at organizations that custody crypto or move large fiat sums.
A few things worth flagging for your team. DPAPI-bound payloads will defeat off-host analysis, so build a runbook for in-place memory capture using something like WinPMem or Velociraptor before you need it. Hunt for unsigned processes making outbound TLS to freshly registered domains from accounts that have no business doing so. Review any developer machine that joined a Zoom or Teams call with an unknown recruiter in the past 90 days.
Defender checklist:
- Pull EDR memory dumps (not just file artifacts) from any host showing the DPAPILoader IOCs published by Fox-IT, and analyze on the originating host.
- Block execution of unsigned binaries from %APPDATA%, %TEMP%, and user Downloads via WDAC or AppLocker — Lazarus loaders still land there.
- Force hardware-key MFA (FIDO2) on every account with signing authority over wallets, exchange APIs, or wire transfers. No SMS, no TOTP fallback.
- Brief developers and finance staff specifically on the fake-recruiter Zoom call lure. Show them a real example.
- If you custody crypto, log and alert on any new outbound connection from a workstation to a node RPC endpoint that is not on your approved list.
Small lifts. Big payoff.
