{"data":{"id":1714,"lang":"en","title":"North Korea's Lazarus Group Deploys Memory-Only 'RemotePE' Trojan Against Crypto and Financial Firms","summary":"Fox-IT researchers detail RemotePE, a fileless memory-only RAT used by North Korea's Lazarus Group to target crypto and financial firms via Telegram social engineering.","category":"technology","category_label":"Technology","published_at":"2026-05-26T02:01:05Z","updated_at":"2026-05-26T02:01:05Z","url":"https://techtools.cz/tools/news/article/1714-north-korea-s-lazarus-group-deploys-memory-only-remotepe-trojan-against-crypto","api_url":"https://techtools.cz/news-api/v1/articles/1714?lang=en","markdown_url":"https://techtools.cz/news-api/v1/articles/1714.md?lang=en","image_url":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEinuOeS1qVC0UHhPnJ0jlSdfScsZDRtkI6VU366iePjKdNTqLiqHcqjRcGL-sNBdUkShUH71YDDVwavzXM1cIu2UU9zE8VYgbJYsRUQeWRZAO75JC2vQHYs4saWOM3rQZKFPqNvlL8ASBocRiZXdO1jLgqLuCCeLHX0bAA1EQEhiBAq3i3Os97qHt_xF5ub/s1700-e365/crypto-firms.jpg","word_count":165,"reading_time_minutes":1,"sources":[{"url":"https://thehackernews.com/2026/05/lazarus-deploys-remotepe-memory-only.html","domain":"thehackernews.com"},{"url":"https://blog.fox-it.com/2026/05/22/remotepe-the-lazarus-rat-that-lives-in-memory/","domain":"blog.fox-it.com"},{"url":"https://www.cryptopolitan.com/north-korea-lazarus-target-crypto-banks/","domain":"cryptopolitan.com"}],"translation":{"lang":"cs","id":1787,"title":"Severokorejská skupina Lazarus nasazuje trojského koně „RemotePE“ žijícího jen v paměti proti kryptofirmám a finančním institucím","url":"https://techtools.cz/tools/news/clanek/1787-severokorejska-skupina-lazarus-nasazuje-trojskeho-kone-remotepe-zijiciho-jen-v","api_url":"https://techtools.cz/news-api/v1/articles/1787?lang=cs"},"content":"Cybersecurity researchers at NCC Group subsidiary Fox-IT have detailed RemotePE, a stealthy C++ remote access trojan used by the North Korea-linked Lazarus Group against financial and cryptocurrency organizations. The malware is delivered through a three-stage chain: DPAPILoader decrypts and loads RemotePELoader using the Windows Data Protection API, which then fetches the final RemotePE payload that runs entirely in memory without ever touching disk.\n\nThe attacks begin with social engineering. Operators approach victims on Telegram while posing as employees of a trading company, then lure them to fake Calendly and Picktime meeting domains to compromise their devices. RemotePE uses evasion tricks like Hell's Gate and ETW patching, leaving a minimal forensic footprint that researchers say is purpose-built for long-term observation before a high-value heist.\n\nThe scale of the threat is significant: North Korea-linked hackers are credited with roughly $577 million in crypto theft in the first four months of 2026 alone, about 76% of all global crypto thefts, and an estimated $6 billion stolen since 2017."}}