Lazarus RemotePE Memory-Only RAT — DPAPILoader + RemotePELoader Chain Targeting Financial & Cryptocurrency Firms

Lazarus RemotePE Memory-Only RAT (TL-2026-0579), also tracked as RemotePE campaign, is a high-severity malware campaign, first published 2026-05-25. It is attributed to Lazarus Group (North Korea) with high confidence, affects Microsoft Windows, references 1 CVE (CVE-2017-16237), maps to 39 MITRE ATT&CK techniques (T1003.001, T1021.001, T1033), and is covered by 9 detection rules and 65 indicators of compromise.

Key facts for TL-2026-0579

Threat ID
TL-2026-0579
Also known as
RemotePE campaign, Three Lazarus RATs, Lazarus DeFi Telegram lure, Fox-IT RemotePE disclosure
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-05-25
Last reviewed
2026-05-25
Attribution
Lazarus Group
Attribution confidence
HIGH
Nation-state nexus
North Korea
Motivation
FINANCIAL
Target sectors
financial services, cryptocurrency, decentralized finance, investment firms, trading platforms
Target regions
Global, North America, Europe, Asia
Detection rules
9
Indicators of compromise
65

Malware and tooling in Lazarus RemotePE Memory-Only RAT

Malware and tooling: DPAPILoader, POOLRAT, PerfhLoader, RemotePE, RemotePELoader, SimpleTea (ELF), ThemeForestRAT, Custom Lazarus RemotePE C2, Fast Reverse Proxy (frpc) v0.32.1, Mimikatz, Proxymini SOCKS proxy, Themida-packed Quasar RAT

North Korea-linked Lazarus Group is deploying RemotePE, a memory-only C++ RAT, against financial and DeFi/cryptocurrency organizations. A three-stage chain (DPAPILoader -> RemotePELoader -> RemotePE) uses Windows DPAPI for environmental keying so the encrypted payload cannot be analyzed without the victim host; the final RAT executes entirely in memory with Hell's Gate direct syscalls and ETW patching. Initial access is via Telegram social engineering with fake Calendly/Picktime/OnceHub meeting domains, attributed by NCC Group/Fox-IT to a Lazarus subgroup overlapping with AppleJeus, Citrine Sleet, UNC4736, and Gleaming Pisces.

How Lazarus RemotePE Memory-Only RAT works

Lazarus Group (DPRK) — specifically the financially motivated subgroup tracked as AppleJeus / Citrine Sleet / UNC4736 / Gleaming Pisces — is running a long-running intrusion campaign against decentralized finance (DeFi), cryptocurrency trading, and traditional financial firms. The campaign was first publicly disclosed by NCC Group's Fox-IT on 2025-09-01 based on a 2024 incident response engagement, and on 2026-05-25 was further extended with details of the previously-undocumented RemotePE memory-only RAT. The full toolset spans three RAT families used in succession: PondRAT (a lightweight POOLRAT/SIMPLESEA variant) and ThemeForestRAT for the first ~3 months of access, then a clean-up and switch to the stealthier DPAPILoader -> RemotePELoader -> RemotePE chain for long-term persistence.

Initial access is social-engineering driven. The actor poses on Telegram as an employee of a legitimate trading firm and steers the victim to a fake meeting-scheduling page on calendly[.]live, picktime[.]live, oncehub[.]co, or go.oncehub[.]co. Visiting these sites is suspected to deliver a Chrome zero-day; post-exploitation activity then leverages the SessionEnv service's vulnerability to phantom DLL loading (tsvipsrv.dll dropped in %SystemRoot%\System32\), with SeDebugPrivilege and SeLoadDriverPrivilege added under HKLM\SYSTEM\CurrentControlSet\Services\SessionEnv\RequiredPrivileges and the service set to auto-start via `sc config sessionenv start=auto`. SYSTEM-level escalation is achieved by abusing the vulnerable VIAGLT64.SYS driver (CVE-2017-16237). Historically the same operator used IKEEXT phantom DLL loading via wlbsctrl.dll.

PerfhLoader is the first-stage loader, reading an encrypted blob from %SystemRoot%\System32\perfh011.dat and decoding it with a rolling-XOR scheme using a 16-byte key array (indices (idx+5)&0xF, (idx-3)&0xF, (idx-7)&0xF). The decrypted payload is PondRAT, a cross-platform (Windows/Linux/macOS) C++ RAT that supports 12 commands keyed by opcodes 0x892-0x89C (Sleep, MsgDown/MsgUp file I/O, Ping, in-memory PE load, MsgRun process launch, MsgCmd shell, Exit, status codes, and Windows-only shellcode injection at 0x89C). PondRAT decodes strings with a fixed 32-byte XOR key (774C71664D5D25775478607E74555462773E525E18237947355228337F433A3B).

ThemeForestRAT runs in parallel with PondRAT and is a fuller-featured RAT with a 30+ command surface (opcodes 0x10001000-0x1000101E) covering directory listing, file copy/delete/upload/download, secure deletion, timestomping to mspaint.exe times, ZIP download, process listing/kill, hibernation, configuration get/set, TCP connection testing, background command execution, RunAs under a WTS session token, and Windows-only shellcode injection at 0x1000101E. Configuration is RC4-encrypted with the static key 201A192D838F4853E300 and stored as netraid.inf (Windows, 43,048 bytes), /var/crash/cups (Linux), or /private/etc/imap (macOS). Compile timestamp on the ThemeForestRAT Windows sample is 2023-09-07 06:40:40. ThemeForestRAT has historical code lineage to RomeoGolf (Operation Blockbuster, compiled 2013-10-11).

Once the operator establishes durable access, PerfhLoader/PondRAT/ThemeForestRAT are removed and replaced with the RemotePE chain. DPAPILoader (Iassvc.dll, earliest sample 2023-11) reads an encrypted blob from disk and decrypts it via Windows CryptUnprotectData (DPAPI), yielding RemotePELoader entirely in memory. Because DPAPI keys are derived from the victim's user/machine secret, the on-disk encrypted RemotePELoader is effectively environment-keyed: analysts who recover only the encrypted file from a triage image cannot decrypt it without the original host's DPAPI master key. RemotePELoader then beacons over HTTP to aes-secure[.]net (or azureglobalaccelerator[.]com) and pulls the final RemotePE module, which executes only in process memory and never touches disk.

RemotePE is a C++ RAT with six command categories: C2 configuration management, directory/DLL operations, file operations, process management, sleep/exit, and server ping. It uses Hell's Gate-style direct syscalls (resolving Nt* syscall numbers at runtime by parsing in-memory ntdll exports) to bypass user-mode API hooks, and patches Event Tracing for Windows (ETW) in the local process to suppress provider events used by EDR. File deletion overwrites each target seven times with constant bytes before renaming and deleting, a forensic-defeating pattern inherited from POOLRAT/SIMPLESEA. RemotePE's internal class layout (IMiddleController, IChannelController, IConfigProfile, IKernelModule) and its C2 string identifiers (MicrosoftApplicationsTelemetryDeviceId, armAuthorization, ai_session) are XOR-encoded in the binary and were used by Fox-IT to author YARA hunting rules. First RemotePE sample timestamp is 2023-07-04; the family's development window runs mid-2023 through mid-2024.

Supporting tradecraft includes Mimikatz, a custom Chromium credential/cookie dumper writing to %LocalAppData%\IconCache.log, Windows and macOS keyloggers (tmpntl.dat, TMP01.dat, /private/etc/xmem) and screenshotters (%LocalAppData%\Microsoft\Software\Cache, /private/etc/tls3), SysInternals ADExplorer (renamed adepfx.exe, output hsu.dat) and Nthandle (hd.exe, output pfu.dat), Fast Reverse Proxy v0.32.1 (fp.exe, config fpc.dat, server 144.172.74.120), Proxymini SOCKS proxy (msnprt.exe), and a Themida-packed Quasar RAT (cmui.exe) with C2 192.52.166.253. Process injection uses the manual mapping pattern via NtOpenProcess -> NtAllocateVirtualMemory -> NtWriteVirtualMemory -> RtlCreateUserThread. As of disclosure, neither RemotePELoader nor RemotePE had VirusTotal coverage.

MITRE ATT&CK techniques used in TL-2026-0579

Credential Access

T1003.001 OS Credential Dumping: LSASS Memory; T1056.001 Input Capture: Keylogging; T1555.003 Credentials from Password Stores: Credentials from Web Browsers

Lateral Movement

T1021.001 Remote Services: Remote Desktop Protocol; T1570 Lateral Tool Transfer

Discovery

T1033 System Owner/User Discovery; T1057 Process Discovery; T1083 File and Directory Discovery

Defense Evasion

T1036 Masquerading; T1055 Process Injection; T1070.004 Indicator Removal: File Deletion; T1070.006 Indicator Removal: Timestomp; T1140 Deobfuscate/Decode Files or Information; T1620 Reflective Code Loading

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1059.003 Command and Scripting Interpreter: Windows Command Shell; T1106 Native API; T1203 Exploitation for Client Execution

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1134 Access Token Manipulation

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1090.002 Proxy: External Proxy; T1105 Ingress Tool Transfer; T1573.001 Encrypted Channel: Symmetric Cryptography

Collection

T1113 Screen Capture; T1115 Clipboard Data; T1560 Archive Collected Data

Initial Access

T1189 Drive-by Compromise; T1566.002 Phishing: Spearphishing Link; T1566.003 Phishing: Spearphishing via Service

Persistence

T1543.003 Create or Modify System Process: Windows Service

defense-impairment

T1553.006 Code Signing Policy Modification; T1685 Disable or Modify Tools

stealth

T1574.001 DLL

Resource Development

T1583.001 Acquire Infrastructure: Domains; T1585.001 Establish Accounts: Social Media Accounts; T1587.001 Develop Capabilities: Malware

Reconnaissance

T1589 Gather Victim Identity Information

Impact

T1657 Financial Theft

Affected products and versions in Lazarus RemotePE Memory-Only RAT

  • Microsoft — Windows
    Vulnerable versions: 10; 11; Server 2016; Server 2019; Server 2022
  • Apple — macOS
    Vulnerable versions: 12 Monterey; 13 Ventura; 14 Sonoma
  • Linux — Linux (multiple distros)
    Vulnerable versions: kernel 5.x; kernel 6.x
  • VIA — VIAGLT64.SYS kernel driver
    Vulnerable versions: all versions affected by CVE-2017-16237
    Fixed in: blocked via Microsoft Vulnerable Driver Blocklist

Remediation for Lazarus RemotePE Memory-Only RAT

Patches

  • VIAGLT64.SYS (CVE-2017-16237) — driver should be blocked via Microsoft vulnerable driver blocklist (WDAC).
  • Keep Chromium-based browsers current; recent zero-day exploitation against DeFi staff has been reported.

Immediate actions

  • Block aes-secure[.]net, azureglobalaccelerator[.]com, azuredeploypackages[.]net, arcashop[.]org, jdkgradle[.]com, latamics[.]org, lmaxtrd[.]com, paxosfuture[.]com, plexisco[.]com, ftxstock[.]com, natefi[.]org, nansenpro[.]com, dpkgrepo[.]com, pypilibrary[.]com, pypistorage[.]com, keondigital[.]com at the perimeter (DNS sinkhole + egress firewall).
  • Block fake scheduling lures calendly[.]live, picktime[.]live, oncehub[.]co, go.oncehub[.]co at web proxy / secure web gateway.
  • Block outbound 144.172.74.120 and 192.52.166.253.
  • Hunt for tsvipsrv.dll and wlbsctrl.dll in %SystemRoot%\System32\ and for perfh011.dat anywhere outside the legitimate perfcounter set.
  • Hunt for Iassvc.dll on disk, and for netraid.inf, /var/crash/cups, /private/etc/imap as ThemeForestRAT config artifacts.
  • Hunt for modifications to HKLM\SYSTEM\CurrentControlSet\Services\SessionEnv\RequiredPrivileges granting SeDebugPrivilege/SeLoadDriverPrivilege and for SessionEnv StartType set to 2 (auto).

Workarounds

  • Disable or restrict SessionEnv service where Remote Desktop Services session environment management is not required.
  • Restrict execution of unsigned DLLs from %SystemRoot%\System32\ via AppLocker / WDAC.

Longer-term hardening

  • Deploy EDR with kernel-callback-based telemetry (not ETW-only) since RemotePE patches ETW in-process.
  • Apply Fox-IT/NCC YARA rules (Lazarus_DPAPILoader_Hunting, Lazarus_RemotePE_C2_strings, Lazarus_RemotePE_class_strings, Lazarus_PerfhLoader_XOR_key, Lazarus_ThemeForestRAT_C2_strings, Lazarus_ThemeForestRAT_RC4_key) to memory scans.
  • Implement out-of-band browser sandboxing for employee-facing systems in finance/crypto roles given suspected Chrome 0-day delivery.
  • Enforce LOLBins egress monitoring for msiexec.exe and services.exe (SessionEnv) reaching the internet.
  • Train DeFi/treasury staff to never accept meeting links delivered via Telegram from new contacts; require all external meetings via known corporate scheduler.
  • Audit Microsoft-signed driver allow-listing to block VIAGLT64.SYS (CVE-2017-16237) and similar BYOVD candidates.

CVEs associated with Lazarus RemotePE Memory-Only RAT

CVE-2017-16237

Weaknesses (CWE) in Lazarus RemotePE Memory-Only RAT

CWE-427, CWE-426, CWE-829, CWE-1188

Timeline of Lazarus RemotePE Memory-Only RAT

  • RomeoGolf RAT compiled (Fri Oct 11 01:20:48 2013) — Operation Blockbuster ancestor of ThemeForestRAT, demonstrating long Lazarus code lineage.
  • POOLRAT (SIMPLESEA) and an early ThemeForestRAT variant observed together against a Lazarus victim, with IKEEXT phantom DLL loading via wlbsctrl.dll.
  • Earliest RemotePE sample compiled — start of the RemotePE family development window.
  • ThemeForestRAT Windows build compiled (Thu Sep 07 06:40:40 2023).
  • Earliest DPAPILoader (Iassvc.dll) artifact observed in the wild.
  • Fox-IT engaged on a DeFi victim incident; PondRAT and ThemeForestRAT observed running in parallel for ~3 months.
  • Operator cleans up PerfhLoader, PondRAT, and ThemeForestRAT; replaces them with DPAPILoader -> RemotePELoader -> RemotePE for long-term stealthy persistence.
  • Fox-IT publishes 'Three Lazarus RATs coming for your cheese' detailing PondRAT, ThemeForestRAT, and the RemotePE chain with full IOCs and YARA rules.
  • The Hacker News and SOC Prime publish follow-on coverage; ampcuscyber and gbhackers report suspected Chrome zero-day in the delivery chain.
  • The Hacker News publishes extended RemotePE memory-only RAT analysis covering command set, anti-analysis (Hell's Gate, ETW patching, 7-pass overwrite), and confirms no VirusTotal coverage at time of disclosure.
  • As of 2026-05-29, this Lazarus RemotePE campaign remains an active live threat: Fox-IT's 2026-05-22 analysis reports successful C2 delivery as recent as July 2025 with some servers still live, and the memory-only RAT still had zero VirusTotal coverage at disclosure. Lazarus/TraderTraitor stayed prolific in 2026, stealing $577M in crypto (76% of global thefts) in four months plus the ~$290M KelpDAO heist, undeterred by repeated OFAC sanctions.

Sources cited for Lazarus RemotePE Memory-Only RAT

Threats related to Lazarus RemotePE Memory-Only RAT

Detection coverage for TL-2026-0579

As of 2026-05-25, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0579 across Splunk SPL, Microsoft KQL and Sigma, covering 65 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats