Lazarus Group Exploits New RemotePE Malware to Target Crypto Firms

A new type of fileless remote access trojan (RAT) named RemotePE has been identified by cybersecurity analysts, according to ChainCatcher. The malware is reportedly being used by the North Korean-linked cybercrime group Lazarus Group to attack banks and cryptocurrency companies. RemotePE operates entirely in memory, making it difficult for traditional antivirus and forensic tools to detect. Attackers impersonate trading company employees on Telegram, using fake Calendly and Picktime links for social engineering attacks. The malware is deployed in three stages—DPAPILoader, RemotePELoader, and RemotePE—without touching the file system, employing process hollowing, anti-analysis checks, and encrypted C2 communications to evade detection. The malware was first discovered in September 2025. In the first four months of 2026, the Lazarus Group has stolen approximately $577 million in crypto assets, accounting for 76% of the global total of crypto thefts. Since 2017, the group has accumulated a total of $6 billion in stolen funds.