TLDR Tech / InfoSec
North Korea's Lazarus Group uses new RemotePE malware against financial targets
Fox-IT (NCC Group) has attributed RemotePE, a cross-platform in-memory RAT delivered through a two-loader chain (DPAPILoader and RemotePELoader) that uses DPAPI decryption, Hell's Gate, and ETW patching to evade detection, to North Korea's Lazarus Group, which reserves the toolset for long-term stealthy access against high-value financial and cryptocurrency targets.
Read the full story