RemotePE: Inside Lazarus’s In-Memory RAT and Its DPAPI-Keyed Three-Stage Loader Chain

Attribution. This is an original English rewrite based on “RemotePE: The Lazarus RAT that lives in memory” by Yun Zheng Hu and Mick Koomen on the Fox-IT (NCC Group) International blog (published 22 May 2026). All research, screenshots, tables, IOCs and YARA rules are the original authors’ work. Figures, IOCs, YARA rules and command tables…

https://core-jmp.org/2026/05/remotepe-lazarus-in-memory-rat-dpapi-loader-chain/