# North Korea's Lazarus Group Deploys Memory-Only 'RemotePE' Trojan Against Crypto and Financial Firms

*2026-05-26 02:01 UTC · Technology · 1 min read*

> Fox-IT researchers detail RemotePE, a fileless memory-only RAT used by North Korea's Lazarus Group to target crypto and financial firms via Telegram social engineering.

Cybersecurity researchers at NCC Group subsidiary Fox-IT have detailed RemotePE, a stealthy C++ remote access trojan used by the North Korea-linked Lazarus Group against financial and cryptocurrency organizations. The malware is delivered through a three-stage chain: DPAPILoader decrypts and loads RemotePELoader using the Windows Data Protection API, which then fetches the final RemotePE payload that runs entirely in memory without ever touching disk.

The attacks begin with social engineering. Operators approach victims on Telegram while posing as employees of a trading company, then lure them to fake Calendly and Picktime meeting domains to compromise their devices. RemotePE uses evasion tricks like Hell's Gate and ETW patching, leaving a minimal forensic footprint that researchers say is purpose-built for long-term observation before a high-value heist.

The scale of the threat is significant: North Korea-linked hackers are credited with roughly $577 million in crypto theft in the first four months of 2026 alone, about 76% of all global crypto thefts, and an estimated $6 billion stolen since 2017.

## Sources

- [thehackernews.com](https://thehackernews.com/2026/05/lazarus-deploys-remotepe-memory-only.html)
- [blog.fox-it.com](https://blog.fox-it.com/2026/05/22/remotepe-the-lazarus-rat-that-lives-in-memory/)
- [cryptopolitan.com](https://www.cryptopolitan.com/north-korea-lazarus-target-crypto-banks/)

---
TechTools News · https://techtools.cz/tools/news/article/1714-north-korea-s-lazarus-group-deploys-memory-only-remotepe-trojan-against-crypto
Česká verze: https://techtools.cz/tools/news/clanek/1787-severokorejska-skupina-lazarus-nasazuje-trojskeho-kone-remotepe-zijiciho-jen-v