Lazarus Deploys RemotePE Memory-Only RAT Against Financial and Crypto Firms
Fox-IT reveals Lazarus Group's RemotePE, a cross-platform memory-only RAT targeting financial and crypto firms. It uses DPAPILoader and RemotePELoader in a multi-stage chain, executing entirely in memory with EDR evasion. The toolset is purpose-built for stealthy long-term access before high-impact theft.