Lazarus RemotePE Memory-Only RAT — DPAPILoader + RemotePELoader Chain Targeting Financial & Cryptocurrency Firms — Threadlinqs Intelligence
As of 2026-05-30, Lazarus RemotePE Memory-Only RAT — DPAPILoader + RemotePELoader Chain Targeting Financial & Cryptocurrency Firms is a high-severity malware threat attributed to Lazarus Group (North Korea), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 65 indicators of compromise.
Threat ID: TL-2026-0579 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: Lazarus Group · North Korea · FINANCIAL
North Korea-linked Lazarus Group is deploying RemotePE, a memory-only C++ RAT, against financial and DeFi/cryptocurrency organizations. A three-stage chain (DPAPILoader -> RemotePELoader -> RemotePE)
Lazarus Group (DPRK) — specifically the financially motivated subgroup tracked as AppleJeus / Citrine Sleet / UNC4736 / Gleaming Pisces — is running a long-running intrusion campaign against decentralized finance (DeFi), cryptocurrency trading, and traditional financial firms. The campaign was first publicly disclosed by NCC Group's Fox-IT on 2025-09-01 based on a 2024 incident response engagement, and on 2026-05-25 was further extended with details of the previously-undocumented RemotePE memory-only RAT. The full toolset spans three RAT families used in succession: PondRAT (a lightweight POOLRAT/SIMPLESEA variant) and ThemeForestRAT for the first ~3 months of access, then a clean-up and switch to the stealthier DPAPILoader -> RemotePELoader -> RemotePE chain for long-term persistence.
Initial access is social-engineering driven. The actor poses on Telegram as an employee of a legitimate trading firm and steers the victim to a fake meeting-scheduling page on calendly[.]live, picktime[.]live, oncehub[.]co, or go.oncehub[.]co. Visiting these sites is suspected to deliver a Chrome zero-day; post-exploitation activity then leverages the SessionEnv service's vulnerability to phantom DLL loading (tsvipsrv.dll dropped in %SystemRoot%\System32\), with SeDebugPrivilege and SeLoadDriverPrivilege added under HKLM\SYSTEM\CurrentControlSet\Services\SessionEnv\RequiredPrivileges and the service set to auto-start via `sc config sessionenv start=auto`. SYSTEM-level escalation is achieved by abusing the vulnerable VIAGLT64.SYS driver (CVE-2017-16237). Historically the same operator used IKEEXT phantom DLL loading via wlbsctrl.dll.
PerfhLoader is the first-stage loader, reading an encrypted blob from %SystemRoot%\System32\perfh011.dat and decoding it with a rolling-XOR scheme using a 16-byte key array (indices (idx+5)&0xF, (idx-3)&0xF, (idx-7)&0xF). The decrypted payload is PondRAT, a cross-platform (Windows/Linux/macOS) C++ RAT that supports 12 commands keyed by opcodes 0x892-0x89C (Sleep, MsgDown/MsgUp file I/O, Ping, in-memory PE load, MsgRun process launch, MsgCmd shell, Exit, status codes, and Windows-only shellcode injection at 0x89C). PondRAT decodes strings with a fixed 32-byte XOR key (774C71664D5D25775478607E74555462773E525E18237947355228337F433A3B).
ThemeForestRAT runs in parallel with PondRAT and is a fuller-featured RAT with a 30+ command surface (opcodes 0x10001000-0x1000101E) covering directory listing, file copy/delete/upload/download, secure deletion, timestomping to mspaint.exe times, ZIP download, process listing/kill, hibernation, configuration get/set, TCP connection testing, background command execution, RunAs under a WTS session token, and Windows-only shellcode injection at 0x1000101E. Configuration is RC4-encrypted with the static key 201A192D838F4853E300 and stored as netraid.inf (Windows, 43,048 bytes), /var/crash/cups (Linux), or /private/etc/imap (macOS). Compile timestamp on the ThemeForestRAT Windows sample is 2023-09-07 06:40:40. ThemeForestRAT has historical code lineage to RomeoGolf (Operation Blockbuster, compiled 2013-10-11).
Once the operator establishes durable access, PerfhLoader/PondRAT/ThemeForestRAT are removed and replaced with the RemotePE chain. DPAPILoader (Iassvc.dll, earliest sample 2023-11) reads an encrypted blob from disk and decrypts it via Windows CryptUnprotectData (DPAPI), yielding RemotePELoader entirely in memory. Because DPAPI keys are derived from the victim's user/machine secret, the on-disk encrypted RemotePELoader is effectively environment-keyed: analysts who recover only the encrypted file from a triage image cannot decrypt it without the original host's DPAPI master key. RemotePELoader then beacons over HTTP to aes-secure[.]net (or azureglobalaccelerator[.]com) and pulls the final RemotePE module, which executes only in process memory and never touches disk.
RemotePE is a C++ RAT with six command categories: C2 configuration management, directory/DLL operations, file operatio
Weaknesses (CWE)
CWE-427, CWE-426, CWE-829, CWE-1188
Target sectors: financial services, cryptocurrency, decentralized finance, investment firms, trading platforms
Target regions: Global, North America, Europe, Asia
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 65 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, CVE-2017-16237, T1589, T1583.001, T1587.001, T1585.001, T1566.002, T1566.003, T1189, T1059.003, T1106, T1203