Lazarus Group Deploys New RemotePE Malware Against Crypto Firms

The notorious North Korean hacking collective known as the Lazarus Group has launched a sophisticated cyber campaign utilizing a new fileless Remote Access Trojan (RAT) named RemotePE. This latest threat specifically targets financial institutions and cryptocurrency companies, marking a significant escalation in the group's technical capabilities. By operating entirely within a system's memory, the malware bypasses traditional security protocols, posing a severe risk to digital asset service providers and global banking infrastructure.

Social Engineering and Technical Sophistication

The attack vector relies heavily on social engineering tactics conducted via messaging platforms such as Telegram. Security analysts report that attackers impersonate employees from reputable trading firms to establish trust with potential victims. This method exploits human psychology rather than software vulnerabilities to gain initial access. Once contact is established, the hackers provide malicious links disguised as legitimate Calendly or Picktime invitations.

The technical execution of RemotePE is characterized by a complex three-stage loading process:

• DPAPILoader: The initial stage designed to bypass local security measures.
• RemotePELoader: A secondary component that prepares the environment for the final payload.
• RemotePE: The core RAT that executes commands and exfiltrates data from the compromised system.

Detection Evasion and Stealth Mechanisms

First observed in September 2025, RemotePE is categorized as fileless malware because it does not touch the host's physical file system. Instead, it utilizes process hollowing, a technique where malicious code is injected into the memory space of a legitimate process. This makes detection nearly impossible for standard antivirus software and traditional forensic tools. Furthermore, the malware incorporates anti-analysis checks to identify if it is being monitored by researchers and employs encrypted Command and Control (C2) communication to hide its traffic from network security monitors.

As the cryptocurrency industry continues to integrate with traditional finance, the focus of state-sponsored groups like Lazarus remains fixed on high-value targets. The deployment of RemotePE highlights the necessity for crypto-focused organizations to implement advanced endpoint detection and response (EDR) solutions that can monitor volatile memory. Cybersecurity experts advise that employees at banks and blockchain firms remain vigilant against unsolicited professional inquiries and verify the authenticity of scheduling links before interaction.