Back Thehackernews

Lazarus Deploys RemotePE Memory

Thehackernews •[email protected] (The Hacker News) • May 25, 2026

Cybersecurity researchers have shed light on a cross-platform malware called RemotePE that has been put to use by the North Korea-linked Lazarus Group in attacks targeting financial and cryptocurrency organizations.

RemotePE, per NCC Group subsidiary Fox-IT, is part of a multi-stage attack chain that involves two loaders tracked as DPAPILoader and RemotePELoader.

"DPAPILoader decrypts and

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Lazarus Group Escalates Attacks with Fileless RemotePE Trojan Targeting Crypto and Banks The Lazarus Group, a North Korea-linked cybercrime organization, has intensified its operations against financial and cryptocurrency sectors using a sophisticated fileless Remote Access Trojan (RAT) called RemotePE. This malware operates entirely in memory, making it difficult to detect and leaving minimal forensic traces. The attack begins with social engineering tactics, where attackers impersonate employees of trading firms via Telegram and use fake scheduling links from platforms like Calendly and Picktime. The malware executes through a three-stage process involving DPAPILoader, RemotePELoader, and the final RemotePE payload, all while avoiding file system interactions. In the first four months of 2026, the Lazarus Group has reportedly stolen approximately $577 million in cryptocurrency, accounting for 76% of global crypto thefts. This marks a significant increase in their operations, with a total of $6 billion stolen since 2017, allegedly funding North Korea's weapons programs amid international sanctions. 12 sources 78

Extracted Entities

Lazarus Deploys RemotePE Memory

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Countries (1)

Industries (1)

Malware (1)

Tools (2)