What Happened
The Lazarus Group — North Korea's most prolific state-sponsored hacking unit — has deployed a new remote access trojan called RemotePE against financial institutions and cryptocurrency firms. Unlike conventional RATs, RemotePE operates entirely in memory. It writes nothing to disk, leaving traditional file-based detection with nothing to find. Fox-IT's analysis confirms the malware injects into legitimate Windows processes and executes all payloads from memory-resident PE (Portable Executable) files — a technique designed to bypass signature-based AV and most EDR solutions.
Technical Analysis
RemotePE's core innovation is its loader. The initial stage — typically delivered through a spear-phishing document or a compromised software update — drops a small bootstrapper that never writes the full RAT to disk. Instead, it allocates executable memory in a legitimate process (commonly svchost.exe or explorer.exe), maps the PE payload into that space, and executes it via thread hijacking. NetCrook reports the loader uses API unhooking to evade user-mode EDR hooks, and direct syscalls to bypass monitoring at the kernel callback layer.
The RAT itself provides full remote desktop access, keylogging, credential harvesting from browser memory, and the ability to deploy additional modules — all without a single malicious file touching the filesystem. CyberSecurityNews has identified that Lazarus is deploying RemotePE alongside two other RAT variants in the same campaign, suggesting a multi-layered persistence strategy: if one RAT is discovered and killed, the others survive.
Who's Affected
The confirmed targets are financial services firms and cryptocurrency exchanges — sectors Lazarus has focused on for years to fund the North Korean regime. DarkDotWeb reports the campaign has active footholds in organizations across Southeast Asia and the Middle East, with initial access likely gained through targeted spear-phishing and supply chain compromises. The group's track record includes the $625M Ronin Bridge theft and the $100M Harmony Horizon attack — this is not an opportunistic threat actor.
Any organization holding significant crypto assets or processing high-volume financial transactions should consider itself a potential target. The memory-only nature of RemotePE means that even organizations with mature endpoint detection may have blind spots.
How to Protect Yourself
Defending against fileless malware requires shifting from file-based to behavior-based detection. Here is what security teams should do now:
- Enable memory scanning in your EDR. Solutions like Microsoft Defender for Endpoint, CrowdStrike Falcon, and SentinelOne all offer memory inspection capabilities — but they are not always enabled by default. Verify that in-memory threat detection is active on all endpoints.
- Monitor for anomalous process injection. Alert on
VirtualAllocEx+WriteProcessMemory+CreateRemoteThreadsequences, especially when the target is a system process. This is the classic process injection triage that RemotePE relies on. - Restrict PowerShell and WMI. Many fileless attacks use PowerShell or WMI as the initial execution vector. Implement Constrained Language Mode and WMI logging to detect abuse.
- Deploy application whitelisting. If only signed, approved executables can run, the bootstrapper stage of the attack chain breaks. Use Windows AppLocker or a third-party whitelisting solution.
- Assume breach for high-value targets. If your organization holds crypto assets or processes large financial transactions, run a memory forensics sweep (using Volatility or a commercial equivalent) on critical endpoints. Look for PE headers in unexpected memory regions.
The Sable Angle
Fileless malware is the natural evolution of the attacker-defender arms race. When defenders got better at scanning files, attackers moved to memory. When defenders start scanning memory, attackers will move again. The point is not to chase the latest evasion technique — it is to assume the attacker is already inside and build detection around behavior, not artifacts.
At Sable Security, our red team engagements simulate exactly this class of threat: fileless initial access, in-memory execution, and lateral movement without touching disk. We test your detection stack against the techniques Lazarus actually uses — not the ones from three-year-old threat reports. If your EDR cannot detect a memory-resident RAT, you do not have endpoint detection. You have endpoint logging. Read our research on how modern APTs exploit the gap between detection theory and detection reality.