Key Findings North Korea-linked Lazarus Group deployed RemotePE, a memory-only RAT, against financial and cryptocurrency organizations RemotePE executes entirely in memory with no filesystem artifacts, making it difficult to detect and analyze Attack chain uses two loaders (DPAPILoader and RemotePELoader) to decrypt and deploy the final payload using Windows DPAPI Malware employs advanced evasion techniques including Hell's Gate and Event Tracing for Windows (ETW) patching Re
