Lazarus Subgroup Deploys Three Custom RATs in Targeted Crypto Attacks

The Lazarus Group sub‑group continues targeting the financial and cryptocurrency sector, with a detailed joint analysis by Fox-IT and NCC Group revealing three custom RATs: PondRAT, ThemeForestRAT and RemotePE. It notes a multi‑stage infection using social engineering as an initial access vector, with a suspicion that a zero‑day might have been used to achieve code execution in one case.

The RATs are staged in memory to reduce forensic visibility, with PondRAT acting as a loader, ThemeForestRAT as a stealthy second‑stage in memory, and RemotePE as the final, more advanced payload using Windows DPAPI for encryption. The investigation also reports credential harvesters, screenshot tools, keyloggers, proxy utilities and the use of public tools like Mimikatz and FRP, and that the actor leveraged the SessionEnv service for persistence enabling loading kernel drivers.

It states the Lazarus operations remain persistent, financially motivated, and technically adaptable, with a tiered approach to intrusion, persistence and stealth.