RemotePE malware targets banks and crypto firms

TLDR

RemotePE is a stealthy, fileless malware attributed to North Koreas Lazarus Group that is now actively targeting both banks and cryptocurrency firms.

1. RemotePE uses social engineering and in?memory payloads to infiltrate targets, leaving almost no disk traces and evading traditional antivirus tools.
2. It has already been used in attacks on DeFi infrastructure and sits within a wider Lazarus campaign that has stolen hundreds of millions of dollars in crypto.
3. Banks, exchanges, DeFi teams, and high?value users need to harden human workflows, development tooling, and endpoint monitoring, not just on?chain security.

Deep Dive

1. How RemotePE Operates

Security researchers describe RemotePE as a fileless remote access tool that runs almost entirely in memory, making it extremely hard to detect with signature?based antivirus. It is linked to the Lazarus Group, a North Korea?aligned hacking outfit known for financial cybercrime against banks and crypto firms.

The typical attack chain starts with social engineering. Operators pose as staff of legitimate investment or trading firms on Telegram, then send fake calendar invites via services mimicking Calendly or similar platforms. When victims open the meeting payload, a DLL called DPAPILoader uses Windows DPAPI to decrypt and load a secondary payload from a command?and?control server directly into RAM, where RemotePE runs while avoiding disk writes and logging, supported by evasion techniques such as Hells Gate and ETW patching, as detailed in a recent technical overview of RemotePE.

2. Impact On Banks And Crypto Firms

RemotePE has already been observed in a real?world compromise of a DeFi firm where it was deployed alongside other malware like PondRAT and ThemeForestRAT, all rated high or very high difficulty to detect and focused on financial targets.

According to analysis summarized in the same RemotePE report, North Korea?linked hackers stole about $577 million in digital assets in just two incidents in the first four months of 2026, accounting for roughly three?quarters of global crypto thefts in that period. Since 2017, crypto thefts attributed to North Korean actors are estimated in the billions of dollars, used in part to fund sanctioned state programs.

3. Risk Reduction For Institutions And Users

For institutions (banks, exchanges, market?makers, DeFi teams), priority defenses include strict verification of unsolicited investment contacts, locked?down use of Telegram and scheduling tools, and endpoint detection that monitors memory behavior and unusual process chains rather than only file signatures. Privileged workstations that touch signing keys or treasury controls should be heavily segmented, with least?privilege accounts and strong hardware?backed authentication.

For individual crypto professionals and high?value users, the highest?impact habits are to distrust unverified outreach offering jobs or investment opportunities, avoid running meeting clients or attachments from unknown parties, and keep large balances in hardware or other cold?style storage with separate, well?protected devices.

Conclusion

RemotePE illustrates how state?linked attackers now blend social engineering, fileless malware, and specialized tooling to pivot from peoples devices into banks and crypto infrastructure. The headline risk is not only theft from a single wallet but systemic exposure when a compromised workstation has access to keys, cloud systems, or trading backends. Strengthening human workflows and endpoint security around those access points is the most effective way to blunt this type of campaign.