Lazarus deploys fileless malware to steal crypto

TLDR

North Korea linked Lazarus Group is using a new fileless malware strain called RemotePE to target banks and crypto firms and steal digital assets while evading traditional antivirus tools.

1. RemotePE is a memory only remote access malware, attributed to Lazarus, that runs almost entirely in RAM and leaves minimal traces on disk.
2. Lazarus uses RemotePE in social engineering campaigns against finance and DeFi staff, then chains it with other tools to steal crypto and sensitive credentials.
3. Crypto users and firms should harden against social engineering, restrict signing environments, and monitor for memory based threats, not just file based malware.

Deep Dive

1. What RemotePE Is And How It Works

Security researchers have identified a fileless malware strain called RemotePE, attributed to the Lazarus Group, that targets banks and cryptocurrency companies. It was first seen in September 2025 and remains active into 2026.

RemotePE is delivered via a loader DLL dubbed DPAPILoader, which abuses Windows Data Protection API (DPAPI) to decrypt an encrypted payload. A component called RemotePELoader then fetches the main payload from a remote command and control server and loads it directly into memory, where RemotePE executes without creating traditional files on disk.

Analysts report that RemotePE uses advanced evasion techniques such as Hells Gate and ETW (Event Tracing for Windows) patching to bypass common endpoint detection, helping it operate as an almost purely in memory backdoor with very high detection difficulty.

2. How Lazarus Uses It To Steal Crypto

According to incident reports, Lazarus typically starts attacks with sophisticated social engineering. Operators impersonate investment firm staff on Telegram, send fake meeting invites via services like Calendly and Picktime, and walk victims through steps that ultimately install DPAPILoader and RemotePE.

In at least one recent case, a DeFi company was breached in a chained attack that used RemotePE together with malware families PondRAT and ThemeForestRAT to gain persistent remote access and exfiltrate data from finance systems. Once inside, the group can capture wallet keys, exchange credentials, VPN access, and internal signing workflows, enabling direct theft of crypto.

TRM Labs data cited in the same research notes that North Korea linked hackers, largely driven by Lazarus, stole about 577 million dollars in digital assets in just two incidents in the first four months of 2026, roughly 76 percent of global crypto thefts in that period, and around 6 billion dollars since 2017.

3. Practical Defenses For Crypto Users And Firms

For individuals, the largest risk is being drawn into tailored outreach on Telegram, LinkedIn, or email that pushes you to install software or join investment calls. Treat unsolicited meeting links and custom tools as high risk, especially if they ask for security exceptions.

For teams at exchanges, DeFi protocols, or funds, key controls include separating signing from browsing or chat machines, enforcing hardware wallets or HSMs for high value keys, and limiting who can access production wallets or bridge infrastructure. Security stacks should include EDR that inspects process behavior and memory, not only file signatures, and regular key rotation and least privilege should be standard.

Conclusion

Lazarus use of RemotePE shows that the center of gravity for crypto theft is shifting from on chain contract bugs toward highly targeted, fileless intrusions against people and infrastructure. For crypto users and organizations, the most effective response is to treat messaging and meeting tools as part of your attack surface, isolate critical signing and operational systems, and invest in detection that can see memory resident malware and unusual credential use rather than relying only on classic antivirus.