# Lazarus RemotePE Memory-Only RAT — DPAPILoader + RemotePELoader Chain Targeting Financial & Cryptocurrency Firms

> North Korea-linked Lazarus Group is deploying RemotePE, a memory-only C++ RAT, against financial and DeFi/cryptocurrency organizations. A three-stage chain (DPAPILoader -> RemotePELoader -> RemotePE) uses Windows DPAPI for environmental keying so the encrypted payload cannot be analyzed without the victim host; the final RAT executes entirely in memory with Hell's Gate direct syscalls and ETW patching. Initial access is via Telegram social engineering with fake Calendly/Picktime/OnceHub meeting domains, attributed by NCC Group/Fox-IT to a Lazarus subgroup overlapping with AppleJeus, Citrine Sleet, UNC4736, and Gleaming Pisces.

- **Published:** 2026-05-25T00:00:00Z
- **Last reviewed:** 2026-05-25T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0579
- **ID:** TL-2026-0579
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Lazarus Group (North Korea)
- **Detections:** 9 · **IOCs:** 65 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2017-16237

## Description

Lazarus Group (DPRK) — specifically the financially motivated subgroup tracked as AppleJeus / Citrine Sleet / UNC4736 / Gleaming Pisces — is running a long-running intrusion campaign against decentralized finance (DeFi), cryptocurrency trading, and traditional financial firms. The campaign was first publicly disclosed by NCC Group's Fox-IT on 2025-09-01 based on a 2024 incident response engagement, and on 2026-05-25 was further extended with details of the previously-undocumented RemotePE memory-only RAT. The full toolset spans three RAT families used in succession: PondRAT (a lightweight POOLRAT/SIMPLESEA variant) and ThemeForestRAT for the first ~3 months of access, then a clean-up and switch to the stealthier DPAPILoader -> RemotePELoader -> RemotePE chain for long-term persistence.

Initial access is social-engineering driven. The actor poses on Telegram as an employee of a legitimate trading firm and steers the victim to a fake meeting-scheduling page on calendly[.]live, picktime[.]live, oncehub[.]co, or go.oncehub[.]co. Visiting these sites is suspected to deliver a Chrome zero-day; post-exploitation activity then leverages the SessionEnv service's vulnerability to phantom DLL loading (tsvipsrv.dll dropped in %SystemRoot%\System32\), with SeDebugPrivilege and SeLoadDriverPrivilege added under HKLM\SYSTEM\CurrentControlSet\Services\SessionEnv\RequiredPrivileges and the service set to auto-start via `sc config sessionenv start=auto`. SYSTEM-level escalation is achieved by abusing the vulnerable VIAGLT64.SYS driver (CVE-2017-16237). Historically the same operator used IKEEXT phantom DLL loading via wlbsctrl.dll.

PerfhLoader is the first-stage loader, reading an encrypted blob from %SystemRoot%\System32\perfh011.dat and decoding it with a rolling-XOR scheme using a 16-byte key array (indices (idx+5)&0xF, (idx-3)&0xF, (idx-7)&0xF). The decrypted payload is PondRAT, a cross-platform (Windows/Linux/macOS) C++ RAT that supports 12 commands keyed by opcodes 0x892-0x89C (Sleep, MsgDown/MsgUp file I/O, Ping, in-memory PE load, MsgRun process launch, MsgCmd shell, Exit, status codes, and Windows-only shellcode injection at 0x89C). PondRAT decodes strings with a fixed 32-byte XOR key (774C71664D5D25775478607E74555462773E525E18237947355228337F433A3B).

ThemeForestRAT runs in parallel with PondRAT and is a fuller-featured RAT with a 30+ command surface (opcodes 0x10001000-0x1000101E) covering directory listing, file copy/delete/upload/download, secure deletion, timestomping to mspaint.exe times, ZIP download, process listing/kill, hibernation, configuration get/set, TCP connection testing, background command execution, RunAs under a WTS session token, and Windows-only shellcode injection at 0x1000101E. Configuration is RC4-encrypted with the static key 201A192D838F4853E300 and stored as netraid.inf (Windows, 43,048 bytes), /var/crash/cups (Linux), or /private/etc/imap (macOS). Compile timestamp on the ThemeForestRAT Windows sample is 2023-09-07 06:40:40. ThemeForestRAT has historical code lineage to RomeoGolf (Operation Blockbuster, compiled 2013-10-11).

Once the operator establishes durable access, PerfhLoader/PondRAT/ThemeForestRAT are removed and replaced with the RemotePE chain. DPAPILoader (Iassvc.dll, earliest sample 2023-11) reads an encrypted blob from disk and decrypts it via Windows CryptUnprotectData (DPAPI), yielding RemotePELoader entirely in memory. Because DPAPI keys are derived from the victim's user/machine secret, the on-disk encrypted RemotePELoader is effectively environment-keyed: analysts who recover only the encrypted file from a triage image cannot decrypt it without the original host's DPAPI master key. RemotePELoader then beacons over HTTP to aes-secure[.]net (or azureglobalaccelerator[.]com) and pulls the final RemotePE module, which executes only in process memory and never touches disk.

RemotePE is a C++ RAT with six command categories: C2 configuration management, directory/DLL operations, file operations, process management, sleep/exit, and server ping. It uses Hell's Gate-style direct syscalls (resolving Nt* syscall numbers at runtime by parsing in-memory ntdll exports) to bypass user-mode API hooks, and patches Event Tracing for Windows (ETW) in the local process to suppress provider events used by EDR. File deletion overwrites each target seven times with constant bytes before renaming and deleting, a forensic-defeating pattern inherited from POOLRAT/SIMPLESEA. RemotePE's internal class layout (IMiddleController, IChannelController, IConfigProfile, IKernelModule) and its C2 string identifiers (MicrosoftApplicationsTelemetryDeviceId, armAuthorization, ai_session) are XOR-encoded in the binary and were used by Fox-IT to author YARA hunting rules. First RemotePE sample timestamp is 2023-07-04; the family's development window runs mid-2023 through mid-2024.

Supporting tradecraft includes Mimikatz, a custom Chromium credential/cookie dumper writing to %LocalAppData%\IconCache.log, Windows and macOS keyloggers (tmpntl.dat, TMP01.dat, /private/etc/xmem) and screenshotters (%LocalAppData%\Microsoft\Software\Cache, /private/etc/tls3), SysInternals ADExplorer (renamed adepfx.exe, output hsu.dat) and Nthandle (hd.exe, output pfu.dat), Fast Reverse Proxy v0.32.1 (fp.exe, config fpc.dat, server 144.172.74.120), Proxymini SOCKS proxy (msnprt.exe), and a Themida-packed Quasar RAT (cmui.exe) with C2 192.52.166.253. Process injection uses the manual mapping pattern via NtOpenProcess -> NtAllocateVirtualMemory -> NtWriteVirtualMemory -> RtlCreateUserThread. As of disclosure, neither RemotePELoader nor RemotePE had VirusTotal coverage.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1583.001 Acquire Infrastructure: Domains
- T1587.001 Develop Capabilities: Malware
- T1585.001 Establish Accounts: Social Media Accounts
- T1566.002 Phishing: Spearphishing Link
- T1566.003 Phishing: Spearphishing via Service
- T1189 Drive-by Compromise
- T1059.003 Command and Scripting Interpreter: Windows Command Shell
- T1106 Native API
- T1203 Exploitation for Client Execution
- T1574.001 DLL
- T1543.003 Create or Modify System Process: Windows Service
- T1068 Exploitation for Privilege Escalation
- T1134 Access Token Manipulation
- T1685 Disable or Modify Tools
- T1140 Deobfuscate/Decode Files or Information
- T1620 Reflective Code Loading
- T1070.004 Indicator Removal: File Deletion
- T1070.006 Indicator Removal: Timestomp
- T1036 Masquerading
- T1055 Process Injection
- T1553.006 Code Signing Policy Modification
- T1003.001 OS Credential Dumping: LSASS Memory
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1056.001 Input Capture: Keylogging
- T1033 System Owner/User Discovery
- T1057 Process Discovery
- T1083 File and Directory Discovery
- T1021.001 Remote Services: Remote Desktop Protocol
- T1570 Lateral Tool Transfer
- T1113 Screen Capture
- T1115 Clipboard Data
- T1560 Archive Collected Data
- T1071.001 Application Layer Protocol: Web Protocols
- T1573.001 Encrypted Channel: Symmetric Cryptography
- T1105 Ingress Tool Transfer
- T1090.002 Proxy: External Proxy
- T1041 Exfiltration Over C2 Channel
- T1657 Financial Theft

## Sources

- [Lazarus Deploys RemotePE Memory-Only RAT Against Financial and Crypto Firms](https://thehackernews.com/2026/05/lazarus-deploys-remotepe-memory-only.html)
- [Three Lazarus RATs coming for your cheese — Fox-IT](https://blog.fox-it.com/2025/09/01/three-lazarus-rats-coming-for-your-cheese/)
- [RIFT: Analysing a Lazarus Shellcode Execution Method — NCC Group](https://www.nccgroup.com/research-blog/rift-analysing-a-lazarus-shellcode-execution-method/)
- [Lazarus Group Expands Malware Arsenal With PondRAT, ThemeForestRAT, and RemotePE](https://thehackernews.com/2025/09/lazarus-group-expands-malware-arsenal.html)
- [Lazarus Group Attack Detection — SOC Prime](https://socprime.com/blog/detect-lazarus-attacks-using-three-new-rats/)
- [Lazarus Subgroup Targets Crypto with Triple RAT Arsenal — Ampcus Cyber](https://www.ampcuscyber.com/shadowopsintel/lazarus-subgroup-unleashes-triple-rat-arsenal/)
- [Lazarus Hackers Exploit 0-Day to Deploy Three Remote Access Trojans — GBHackers](https://gbhackers.com/lazarus-hackers-exploit-0-day/)
- [CVE-2017-16237 NVD record (VIAGLT64.SYS)](https://nvd.nist.gov/vuln/detail/CVE-2017-16237)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0579