Loading story…
Fox-IT reported that a Lazarus-linked intrusion set targeted financial and cryptocurrency organizations with a stealthy three-stage malware chain built around DPAPILoader, RemotePELoader, and the memory-resident RemotePE RAT. The first stage decrypts a victim-bound payload using Windows DPAPI and XOR obfuscation, then establishes persistence through masqueraded services or DLL sideloading. The second stage prepares execution by using HellsGate/TartarusGate techniques to evade user-mode hooks and patching ETW telemetry before contacting command-and-control infrastructure for the final payload.
The final-stage RemotePE implant operates entirely in memory and supports file management, process control, command execution, configuration changes, sleep control, and plugin loading without writing itself to disk. Researchers said the toolset is engineered for stealth through environmental keying, low forensic footprint, and likely actor-operated payload delivery, and linked the activity to a North Korean Lazarus subgroup associated with AppleJeus, Citrine Sleet, UNC4736, and Gleaming Pisces. Fox-IT also identified Namecheap-hosted infrastructure, active and historical domains, malware samples, host indicators, and YARA rules to aid detection and response.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
On 2026-05-22, Fox-IT disclosed analysis of a three-stage Lazarus-linked malware chain—DPAPILoader, RemotePELoader, and the memory-only RemotePE RAT—used in an intrusion targeting financial and cryptocurrency organizations. The report linked the activity to a Lazarus subgroup associated with AppleJeus and shared C2 infrastructure, hashes, host indicators, and YARA rules.
In late February 2026, the attackers launched a third wave by redeploying a modified Deed RAT variant from C:\Recovery with updated configuration values and a new C2 domain, showing continued persistence and tooling evolution.
In a later wave during the same campaign, the attackers attempted to deploy Terndoor via a Mofu loader and a USOShared sideloading chain, including an attempted kernel driver service for vmflt.sys. Security controls reportedly blocked full execution of this stage.
Following initial access, the operators installed Deed RAT through a LogMeIn Hamachi-themed DLL sideloading chain and conducted lateral movement using RDP and SMB-based remote execution. The intrusion persisted despite remediation attempts, with repeated re-entry into the environment.
In late December 2025, attackers began a multi-wave intrusion against an Azerbaijani oil and gas company by exploiting an unpatched Microsoft Exchange server in ProxyNotShell-related activity and deploying a web shell.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourceblog.polyswarm.io
Open sourcescworld.com
Open sourcesecurityaffairs.com
Open sourcethehackernews.com
Open sourceblog.fox-it.com
Open sourcebitdefender.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. agencies and private researchers linked multiple cryptocurrency-focused malware campaigns to North Korea’s **Lazarus Group**/**HIDDEN COBRA**, including the **AppleJeus** family delivered through fake but functional trading and wallet applications for **Windows** and **macOS**. CISA reports said variants including **Celas Trade Pro**, **JMT Trading**, **Kupay Wallet**, and **CoinGoTrade** were distributed from spoofed or seemingly legitimate websites such as `celasllc.com`, `jmttrading.org`, and `kupaywallet.com`, often with GitHub-hosted installers. The applications presented benign trading interfaces while secretly installing updater, daemon, or backdoor components that collected host information, established persistence, and fetched encrypted second-stage payloads from attacker-controlled infrastructure. The malware gave operators remote access to victim systems in cryptocurrency exchanges, financial services firms, and related organizations, with capabilities including command execution, file upload and transfer, reconnaissance, and payload staging. CISA tied the campaigns to Lazarus through infrastructure and code overlap with known implants such as **FALLCHILL**, **HOPLIGHT/MANUSCRYPT**, and the **CrashReporter** backdoor, while Proofpoint documented related Lazarus activity using phishing documents, JavaScript downloaders, malicious `LNK` and `CHM` files, and backdoored cryptocurrency apps to deploy **PowerRatankba**, a custom **Gh0st RAT** variant, and **RatankbaPOS**. Together, the reporting shows a sustained Lazarus effort to steal cryptocurrency and gain access to crypto-sector networks by masquerading malware as legitimate trading software.
Aug 15, 2026
Researchers tied the **VHD ransomware** and related families including **BEAF, PXJ, ZZZZ, CHiCHi, and Tflower** to DPRK-affiliated operators, with Trellix and Kaspersky linking the activity to **Lazarus/APT38/Unit 180**. The reporting says the campaigns were narrowly targeted, especially in the APAC region, and appeared aimed at revenue generation rather than mass extortion. Investigators cited shared code, overlapping artifacts, near-identical visual patterns, a reused ProtonMail address, and the use of the **MATA** framework as evidence that these ransomware strains were not typical criminal affiliate tools but part of a state-linked operation. Kaspersky described two 2020 intrusions in which attackers exploited a vulnerable VPN gateway, escalated privileges, deployed **MATA**, seized **Active Directory**, and pushed VHD across victim networks within hours; another case used a custom SMB brute-force spreading tool with propagation over mounted shares and **WMI**. Separate research from Netlab 360 and VMware detailed **Dacls**, also known as **MATA**, as a cross-platform Lazarus-linked RAT for Windows and Linux that uses TLS and RC4-protected command-and-control, modular plugins, and infrastructure that remained active across more than 100 identified C2 servers. Earlier ESET analysis placed the activity within Lazarus’s broader pattern of combining espionage, sabotage, and financially motivated operations through multiple code-sharing development cells.
Aug 15, 2026
Multiple campaigns are using phishing emails and archive-based lures to deliver remote access malware through stealthy, multi-stage infection chains. Point Wild documented **Remcos RAT**, **DesckVB RAT**, and a Rust-based **COVERT RAT** being delivered through ZIP attachments, weaponized `LNK` files, obfuscated JavaScript droppers, and hidden PowerShell execution, often with decoy documents to mask activity. The payloads were loaded filelessly through .NET reflection and in-memory execution, with operators abusing legitimate binaries and services such as `aspnet_compiler.exe`, GitHub, and paste or web-hosting platforms to stage malware while evading detection. Reported command-and-control infrastructure included `192.3.27.141:8087`, `172.245.246.77:8080`, and `181.231.253.69:4444`, while observed artifacts included `C:\ProgramData\remcos\logs.dat`, `C:\ProgramData\colors\logs.dat`, and payload names such as `ALTERNATE.dll`, `ClassLibrary3.dll`, `Keylogger.dll`, and `msedge_proxy.exe`. Separate reporting showed the same tradecraft extending beyond custom RATs to commodity remote-access software and credential theft. A campaign targeting Russian aerospace and aviation organizations used invoice-themed phishing and spoofed domains to install a portable **AnyDesk** instance for unattended access, maintain persistence with a scheduled task, minimize visibility with Tray Minimizer, and exfiltrate configuration data through a command-line SMTP mailer; Seqrite linked the activity to **Rare Werewolf (Librarian Ghouls)**. Securonix research cited by Trojan Killer described **VEIL#DROP** using fake document-style JavaScript files, Blogspot-hosted staging, PowerShell download cradles, XOR decoding, and in-memory .NET loading to deploy **PureLog Stealer**, which targets browser credentials, cookies, session tokens, wallet data, and host information. Across the campaigns, the common pattern is phishing-led initial access followed by LOLBins, PowerShell, staged downloads, persistence, and covert data theft or long-term remote control.
Jul 12, 2026