Loading malware…
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
“RemotePELoader is encrypted on disk using Window’s Data Protection API (DPAPI) and is loaded by DPAPILoader.”
The framework consists of three interconnected malware families: DPAPILoader – First-stage loader responsible for decrypting payloads tied to victim-specific DPAPI keys.
10 distinct techniques documented for this family, organized by ATT&CK tactic.
In one observed intrusion, the malware was deployed as C:\Windows\System32\Iassvc.dll under a malicious Windows service masquerading as the legitimate Internet Authentication Service (IAS). The malware abuses Windows service infrastructure to establish persistence through svchost.exe while imitating legitimate Windows components.
In one observed intrusion, the malware was deployed as C:\Windows\System32\Iassvc.dll under a malicious Windows service masquerading as the legitimate Internet Authentication Service (IAS). The malware abuses Windows service infrastructure to establish persistence through svchost.exe while imitating legitimate Windows components.
After DPAPI decryption, the payload is additionally XORed with 0x8D before loading. This is consistent across all observed DPAPILoader samples.
Researchers noted the malicious DLL intentionally mimicked the legitimate iassvcs.dll naming convention, differing by only a single character.
DPAPILoader functions as the first-stage component responsible for decrypting and executing encrypted payloads tied to the victim environment via the Windows Data Protection API (DPAPI)... The malware applies an additional XOR operation using the constant 0x8D after DPAPI decryption, creating a layered protection mechanism.
Researchers identified multiple DPAPILoader variants utilizing different execution methods, including service execution, DLL sideloading via ESET software, and export-based loading through WMI-related functionality.
Meanwhile, the malware checks the host process and loops over specific device metadata paths.
The final component, a fully featured remote access trojan (RAT), is executed entirely in memory and provides attackers with extensive control over compromised systems.
The attack followed a pattern increasingly common in Lazarus operations, social engineering via Telegram, with operatives posing as employees of a legitimate trading firm, scheduling fake meetings through spoofed Calendly and Picktime domains to gain initial access to a victim’s device.
The first-stage loader decrypts and launches the next component using Windows Data Protection API (DPAPI)... A notable aspect of the campaign is the use of environmental keying through Windows DPAPI.
Meanwhile, the malware checks the host process and loops over specific device metadata paths.
DPAPILoader uses the Windows Data Protection API (DPAPI) to decrypt its payload... each deployment produces a unique encrypted blob, meaning the payload hash differs across victims and evades hash-based detection.
9 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.