Memory as a weapon: Lazarus and the new domain of financial attacks that leave no trace on disk

The research published by Fox-IT on RemotePE, a remote access trojan (RAT) used by the Lazarus group, confirms a critical trend in cyber-threat to finance and cryptomonedas: increasingly designed attacks to remain in memory and avoid leaving disk footprint. Although the execution in memory is not new, the combination of chained loaders, the use of DPAPI to decrypt payloads and evasion techniques such as Hell's Gate and ETW's patching show deliberate development oriented to long-term traceability.

RemotePE does not act alone: it is part of a set of tools where DPAPILOader initiates the process by decrypt and loading RemotePELoader, which in turn downloads and runs RemotePE only in memory. This design significantly reduces forensic evidence in disk and forces the defenses to focus on memory, process telemetry and network traffic.

For financial and cryptomoneda organisations, practical involvement is double. On the one hand, the presence of a chain of intrusion where the actor interacts with the victim (social engineering via Telegram and false Calendly / Picktime domains) stresses that technical security must be complemented by human controls and verifiable processes for meetings, onboarding and access requests. On the other hand, the ability to maintain long-term undetected access increases the risk of high-impact final operations such as financial fraud, key removal or emptying of cryptoactive vaults.

From a technical perspective, there are specific signs to monitor: abuse of DPAPI to store or recover payloads, outgoing connections to suspicious domains such as "aes-secure [.] net," modifications in Windows event instrumentation (ETW) and advanced Hell's Gate techniques. Effective detection requires correlated endpoints telemetry, network records and memory catches before the actor performs high impact actions.

As for malware capabilities, RemotePE implements commands for file management, DLL handling in memory, process control, persistence in the work directory and a delete order that overwrites files repeatedly before deleting them. This elimination pattern, also seen in PondRAT and POOLRAT, suggests an intention to frustrate the forensic analysis after the exfiltration phase or when the operation ends.

For defenders and response teams, operational priorities should include the instrumentation of the memory of endpoints, the blocking of known exfiltration channels and the ability to acquire rapid memory dumping. Tools like Volatility and memory analysis frames become crucial to identify artifacts that never got to disk(more information on Volatility Foundation).

It is also recommended to enrich the detection rules with performance indicators: processes that load unknown modules in memory, processes that make atypical calls to DPAPI, anomalies in the use of ETW and communication patterns to command and control servers. Complementing endpoints telemetry with eBPF monitoring or memory agents can make a difference against memory execution techniques.

The response to a suspected RemotePE infection should prioritize the containment and preservation of evidence in memory: isolate the host, turn memory and collect network traffic, block identified IP domains and addresses, and rotate credentials and keys that may have been compromised. Late detection requires commitment of accounts and credentials; therefore, rotation and integrity verification are essential steps.

At the organizational level, this case reinforces the need to adopt in-depth defence models: strong multifactor authentication, least privileged policies, network segmentation for critical infrastructure and rigid processes for the acceptance of external meetings or access requests. Recurrent training in specific social engineering for popular channels between the critical sector, such as Telegram, must be part of any awareness-raising program.

Finally, understanding the adversary matters: Lazarus has shown a persistent approach to financial and cryptomoneda objectives. Threat intelligence resources such as the MITRE technical data sheets allow to contextualize known group tactics and techniques and adjust defenses accordingly (see profile in MITRE ATT & CK - Lazarus). Sharing information with industry peers and security providers also accelerates the identification of targeted campaigns and the blocking of malicious infrastructure.

The key lesson for organizations at risk is clear: the age of malware that leaves no trace on disk requires visibility over memory, quick response and human controls that prevent initial access. Without these elements, even apparently robust defenses can be the environment in which actors with resources hold silent operations until they execute a high-impact blow.