Lazarus RemotePE Memory-Only RAT Campaign | MSSP Advisory

The North Korea-linked Lazarus Group is deploying RemotePE, a memory-only RAT that operates entirely in RAM without touching disk, making it extremely difficult to detect through traditional endpoint monitoring. The attack uses a multi-stage infection chain with DPAPILoader and RemotePELoader components specifically targeting financial and cryptocurrency organizations. RemotePE executes malicious code directly from memory, bypassing most signature-based detection methods.

Your RMM agents and remote access tools could be compromised by this memory-resident attack without triggering alerts in your monitoring stack, giving attackers persistent access to client networks through your infrastructure. Financial services clients face direct targeting from a nation-state actor with a proven track record of stealing millions from banks and crypto exchanges, and they expect you to know about active campaigns against their sector.

📬