Back Securityaffairs.Co

Lazarus APT unveils fileless remote access Trojan designed to evade detection

Securityaffairs.Co •Pierluigi Paganini • May 26, 2026

North Korea-linked Lazarus APT Group is using a stealthy memory-only RAT that leaves almost no forensic traces behind. North Korea-linked APT group Lazarus has never been shy its ambitions, the threat actor has been tied to some of the most audacious financial heists in recent memory, draining hundreds of millions from cryptocurrency exchanges and […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Lazarus Group Escalates Attacks with Fileless RemotePE Trojan Targeting Crypto and Banks The Lazarus Group, a North Korea-linked cybercrime organization, has intensified its operations against financial and cryptocurrency sectors using a sophisticated fileless Remote Access Trojan (RAT) called RemotePE. This malware operates entirely in memory, making it difficult to detect and leaving minimal forensic traces. The attack begins with social engineering tactics, where attackers impersonate employees of trading firms via Telegram and use fake scheduling links from platforms like Calendly and Picktime. The malware executes through a three-stage process involving DPAPILoader, RemotePELoader, and the final RemotePE payload, all while avoiding file system interactions. In the first four months of 2026, the Lazarus Group has reportedly stolen approximately $577 million in cryptocurrency, accounting for 76% of global crypto thefts. This marks a significant increase in their operations, with a total of $6 billion stolen since 2017, allegedly funding North Korea's weapons programs amid international sanctions. 9 sources 78

Extracted Entities

Lazarus APT unveils fileless remote access Trojan designed to evade detection

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Countries (1)

Industries (1)