Lazarus Goes Ghostless: RemotePE RAT Leaves No Trace on Disk
North Korea's most dangerous hacking collective has weaponized memory-only malware to silently infiltrate financial institutions and crypto firms — and conventional endpoint defenses are blind to it.
Written by OutOfToken AI
June 1, 2026 · 4 min read · Synthesized from reporting by The Hacker News · How this works
The Lazarus Group, North Korea's most prolific state-sponsored threat actor, has deployed a new remote access trojan called RemotePE that operates entirely within system memory — touching no files, leaving no forensic footprint, and bypassing most traditional endpoint detection tools. Researchers at Fox-IT, the threat intelligence arm of NCC Group, have published a detailed technical breakdown of the malware and its associated infection chain, revealing a sophisticated multi-stage operation targeting financial institutions and cryptocurrency organizations. The campaign represents a significant escalation in Lazarus's operational security posture, blending advanced evasion techniques with a modular loader architecture that makes attribution and containment exceptionally difficult.
A Chain Built to Disappear
RemotePE does not arrive alone. It is delivered through a two-stage loader pipeline consisting of components Fox-IT tracks as DPAPILoader and RemotePELoader. DPAPILoader leverages the Windows Data Protection API — a legitimate OS-level cryptographic service — to decrypt an intermediate payload without writing anything to disk. That decrypted component, RemotePELoader, then reaches out to a command-and-control server to pull down the RemotePE payload itself, again entirely in memory. The use of DPAPI is a deliberate choice: it ties decryption to the specific machine and user context, meaning even if investigators seize a copy of the encrypted payload, they cannot decrypt it outside of the compromised environment. It is anti-forensics baked into the operating system's own plumbing.
ETW Patching and Hell's Gate: Killing the Watchers
Once RemotePE is resident in memory, it deploys two well-documented but technically demanding evasion techniques. The first is Event Tracing for Windows (ETW) patching, which involves overwriting ETW-related functions in memory to blind Windows's native telemetry pipeline — effectively preventing the operating system from logging any suspicious API calls the malware might make. The second is Hell's Gate, a syscall-resolution technique that bypasses user-mode API hooks placed by endpoint detection and response platforms by dynamically resolving direct system call numbers from the NT kernel. Together, these techniques neutralize two of the primary layers security vendors rely on for behavioral detection. RemotePE is not just hiding; it is actively dismantling the sensors designed to find it.
""RemotePELoader beacons to a C2 server and executes the final payload entirely in memory — no filesystem artifacts, no persistent writes, no conventional indicators of compromise to collect after the fact." — Fox-IT / NCC Group"
Cross-Platform Ambitions and the Crypto Targeting Pattern
Fox-IT's research indicates RemotePE is engineered as a cross-platform capability, extending Lazarus's reach beyond Windows environments — a notable development for a group that has historically leaned heavily on Windows-centric tooling. The targeting profile is consistent with Lazarus's well-documented financial mandate: cryptocurrency exchanges, DeFi platforms, and traditional financial institutions represent the primary victim set. The group has stolen billions in digital assets over the past decade, with operations like the $625 million Ronin Network breach and the $100 million Horizon Bridge hack establishing a persistent pattern. RemotePE appears designed for prolonged, low-visibility access — the kind of dwell time required to surveil transaction systems, harvest credentials, and stage large-scale fund movements without triggering alarms.
RemotePE underscores a hard reality for defenders in the financial and crypto sectors: signature-based detection and file-system monitoring are increasingly irrelevant against threat actors operating at Lazarus's level. Memory forensics, behavioral analytics tied to syscall-level telemetry, and rigorous monitoring of DPAPI usage patterns are now table stakes, not advanced capabilities. As Lazarus continues to refine its tradecraft — iterating toward fileless, cross-platform, sensor-blinding toolchains — the gap between nation-state offensive capability and enterprise defensive posture will only widen unless the industry responds with equivalent technical seriousness.
Editorial Note
The Hacker News is a reputable cybersecurity news outlet with established credibility. The attribution to Lazarus Group and involvement of NCC Group/Fox-IT (legitimate security firms) lends credibility. Lazarus Group's documented history of targeting financial and crypto sectors aligns with known threat intelligence patterns.
Claim Tracker
AI-assessed
Consistent with NCC Group/Fox-IT published technical research on Lazarus activities
Core technical capability described in Fox-IT's analysis; fileless malware is an established threat category
Specific component names and functions documented in Fox-IT research
DPAPI is a legitimate Windows feature; use for malware payload decryption is documented technique
Describes Lazarus's characterization; 'most prolific' is subjective assessment lacking supporting metrics
Ask AI about this story
// discussion
sign in to join the discussion