Lazarus deploys RemotePE malware on crypto firms

TLDR

North Korea-linked Lazarus Group is using a new fileless malware called RemotePE to infiltrate banks and cryptocurrency firms with highly targeted social engineering attacks.

1. RemotePE is a memory-resident remote access tool that uses a multi-stage loader chain to avoid leaving traces on disk.
2. Lazarus operators social-engineer staff via Telegram and fake Calendly-style meeting links, then deploy RemotePE and related tools to silently take over systems.
3. The group has stolen hundreds of millions of dollars in crypto, so firms handling digital assets need stronger controls around staff communications, endpoint monitoring, and key management.

Deep Dive

1. What RemotePE Actually Does

RemotePE is a fileless remote access tool (RAT) that runs almost entirely in memory, making it hard for traditional antivirus to spot. A RAT lets attackers remotely control an infected machine.

Reports describe a DLL called DPAPILoader that uses Windows DPAPI to decrypt a secondary payload from a command-and-control server, then a RemotePELoader component injects the RemotePE malware directly into memory, avoiding normal disk-based signatures.

Advanced evasion techniques such as Hells Gate and ETW patching help it bypass common detection mechanisms by interfering with how Windows reports and logs malicious behavior.

2. How Lazarus Gets Into Crypto Firms

Lazarus is not just spraying malware; it uses targeted social engineering against finance and crypto staff.

1. Operators impersonate employees of investment or trading firms on Telegram, building rapport in one-to-one chats.
2. They send fake meeting invitations via lookalike scheduling sites such as Calendly or Picktime.
3. The meeting flow guides the victim to execute or enable the first-stage loader, which then pulls in RemotePE and, in some cases, related tools like PondRAT and ThemeForestRAT.

A recent incident cited by researchers involved a DeFi firm whose infrastructure was compromised using a combination of these tools in sequence, giving attackers deep, persistent access to systems that handle digital assets.

3. Scale Of The Threat And Practical Defenses

Analytics cited in recent research attribute around 76 percent of global crypto thefts in early 2026 to North Korea-linked operations, with Lazarus reportedly stealing about $577 million in digital assets in just two major incidents since January and an estimated $6 billion since 2017.

For crypto firms, the highest leverage defenses are organizational rather than purely technical:

1. Treat unsolicited Telegram/Signal outreach from funds or market makers as high risk and verify identities out-of-band.
2. Lock down meeting and file-sharing flows on corporate devices, and restrict the ability for users to run unapproved binaries or scripts.
3. Protect keys and admin credentials with hardware security modules, hardware wallets, strict role separation, and aggressive monitoring for anomalous access.

Conclusion

Lazaruss RemotePE campaign shows how state-grade actors now combine tailored social engineering with stealthy, memory-resident malware to target the crypto sector. For any organization that touches digital assets, the key is to harden staff workflows and endpoint security so that a single convincing message on Telegram or a fake meeting link does not become a multi-million dollar breach.