Lazarus Deploys RemotePE: Memory-Only RAT Targeting Financial and Crypto Firms

This activity is attributed to a North Korean Lazarus subgroup that Fox-IT has tracked since 2025 across multiple incident response engagements. The subgroup's activity overlaps with publicly tracked clusters including AppleJeus, Citrine Sleet (Microsoft), UNC4736 (Mandiant), and Gleaming Pisces (Palo Alto Unit 42). The financial and cryptocurrency focus is consistent across all overlapping clusters.

DPAPILoader is installed as a Windows service DLL masquerading as the legitimate Windows Internet Authentication Service. The filename Iassvc.dll deliberately mimics the legitimate iassvcs.dll (note the missing 's'). It decrypts and loads the next-stage payload from DPAPI-encrypted blobs stored in C:\ProgramData\Microsoft\Windows\DeviceMetadataStore\en-US\*.*, filtering out legitimate Cabinet files by their MSCF magic bytes.

• 1
  DPAPI Environmental Keying: Payloads are encrypted with the victim's own DPAPI credentials. Any extracted blob is useless without the victim's keys — sandboxes and VirusTotal cannot decrypt it.
• 2
  XOR Secondary Layer: After DPAPI decryption, the payload is additionally XOR'd with 0x8D across all bytes, consistent across all observed samples.
• 3
  Host Process Check: DPAPILoader verifies it is running under C:\Windows\System32\Svchost.exe before executing — guards against naive sandbox execution.

RemotePELoader is the operator-controlled staging component. Before performing any network activity, it applies two EDR evasion techniques: Hell's Gate (TartarusGate variant) syscall resolution and ETW patching. It then reads the shared DPAPI-encrypted configuration file, which contains up to three C2 URLs, proxy settings, sleep intervals, and a custom User-Agent string.

• 1
  Hell's Gate / TartarusGate: Dynamically resolves syscall numbers at runtime by scanning in-memory ntdll.dll. Remaps every DLL from KnownDlls kernel objects, replacing EDR-hooked copies with clean versions and effectively unhooking all userland security product hooks.
• 2
  ETW Patching: Overwrites EtwEventWrite() with XOR RAX, RAX; RET (bytes: 48 33 C0 C3), suppressing all ETW event generation and blinding EDR tools that rely on ETW telemetry.

RemotePELoader uses an actor-in-the-loop C2 model: it polls the server at random intervals but only receives RemotePE when the operator manually decides to deliver it. This deliberate pacing limits detection windows and reduces noise.

RemotePE is a C++ multithreaded RAT that executes entirely in memory — it is never written to disk. Fox-IT retrieved samples directly from live C2 servers by emulating the RemotePELoader C2 protocol. It shares the same codebase, configuration file, and C2 protocol structure as RemotePELoader, enforcing chain integrity by checking lpReserved == 0x1000 in DllMain.

• 1
  IConfigProfile: Read and update the C2 configuration on disk — enables operator to pivot C2 infrastructure without re-deploying the toolset.
• 2
  IConsole: Shell command execution, module (DLL) loading/unloading, plugin invocation — the primary lateral movement and execution capability.
• 3
  IFileExplorer: Drive enumeration, directory listing, file read/write/delete/rename, ZIP exfiltration. Secure deletion overwrites files seven times before removing — consistent with PondRAT and POOLRAT.
• 4
  IProcess: Process listing, kill by PID, process creation with impersonation — enables lateral execution and user context switching.
• 5
  Plugin System: Dynamically loads operator-supplied DLL payloads at runtime as "shellcodified DLLs" — extensible attack framework without redeployment.

RemotePE communicates over HTTP using POST requests. Host information is passed via custom Cookie headers that closely mimic legitimate Microsoft telemetry and authentication fields — MicrosoftApplicationsTelemetryDeviceId, MSFPC, armAuthorization — making the traffic blend with normal Microsoft service communications. Each message is AES-GCM encrypted with a key derived from SplitMix64 seeded by a Mersenne Twister PRNG, and the seed is prepended to each message alongside the authentication tag.

* Active at time of Fox-IT publication (May 22, 2026)

• 1
  Suspicious DLLs in System32: Hunt for DLLs in %SystemRoot%\System32\ loaded as Windows services that do NOT appear in baseline image snapshots — specifically look for any file masquerading as a known Windows service DLL with single-character filename differences.
• 2
  DPAPI blobs in DeviceMetadataStore: Baseline normal Cabinet (.cab) files in C:\ProgramData\Microsoft\Windows\DeviceMetadataStore\en-US\. Alert on any file that does NOT begin with MSCF magic bytes (4D 53 43 46) and is larger than 50 KiB.
• 3
  ETW Patch Detection: Monitor for writes of the bytes 48 33 C0 C3 to the address of EtwEventWrite() in any process — this is a definitive indicator of ETW sabotage.
• 4
  Named Event Hunt: Monitor process creation of named Windows events matching 554D5C1F-AABE-49E4-AB57-994D22ECED28 in Windows Event logs or Sysmon Event ID 17/18.