Lazarus Hackers Exploit 0-Day to Deploy Three Remote Access Trojans

According to Fox-IT and NCC Group, Lazarus hackers have been tracked as a sophisticated subgroup targeting financial and cryptocurrency firms, overlapping with campaigns such as AppleJeus, Citrine Sleet, UNC4736 and Gleaming Pisces. The group leverages three distinct remote access trojans—PondRAT, ThemeForestRAT and RemotePE—to infiltrate and control compromised systems, with activity spanning at least 2021 to a 2024 incident response case and beyond.

In mid-2024, an employee at a decentralised finance firm was lured via Telegram by an attacker impersonating a colleague and directed to a spoofed meeting site, after which PondRAT was deployed on the victim’s Windows machine.

Over the following months the actor harvested credentials and network topology data using PondRAT in concert with tools such as a screenshotter, keylogger and browser dumper, alongside public utilities like Mimikatz and the Fast Reverse Proxy client, before installing a more advanced RAT named RemotePE.

The report notes a four-phase attack chain—social engineering, exploitation, discovery and next-stage deployment—and describes PondRAT as a firstloader with a PoolRat lineage, while ThemeForestRAT and RemotePE represent progressively stealthier capabilities. Defenders are urged to monitor for indicators such as phantom-DLL loading, unusual ThemeForest_ or Thumb_ file transfers and sudden drops in endpoint logging that could signal loader activity.