A North Korea-linked Lazarus subgroup targeted financial institutions and cryptocurrency organizations with a multi-stage malware framework built around DPAPILoader, RemotePELoader, and the in-memory RemotePE RAT. The toolset uses Windows DPAPI for environmental keying, making payloads difficult to analyze outside the victim system and reducing the value of hash-based detection. RemotePE provides command execution, file manipulation, process management, and data access, supporting long-term access for financial theft, intelligence collection, or data exfiltration. Cognyte frames the activity as part of Lazarus’ continued shift toward stealth-first, memory-resident tradecraft against high-value financial environments.