Lazarus Group Expands Malware Arsenal With PondRAT, ThemeForestRAT, and RemotePE

The Lazarus Group has been attributed to a social engineering campaign that distributes three cross-platform malware families—PondRAT, ThemeForestRAT, and RemotePE. The attack, observed by NCC Group’s Fox-IT in 2024, targeted a DeFi organisation, ultimately compromising an employee’s system.

According to Fox-IT, the actor impersonated an existing trading company employee on Telegram and used fake websites masquerading as Calendly and Picktime to arrange a meeting with the victim, after which a loader named PerfhLoader drops PondRAT.

PondRAT is described as a straightforward RAT that can read and write files, start processes, and run shellcode, and it communicates with a hard-coded HTTP(S) C2 server to receive further instructions; ThemeForestRAT is launched directly in memory and can be deployed via PondRAT or a dedicated loader.

ThemeForestRAT reportedly shares similarities with RomeoGolf, a malware code-named used by the Lazarus Group in an SPE 2014 operation, while RemotePE is retrieved from a C2 server by RemotePELoader, loaded through DPAPILoader, and is considered more advanced for high-value targets.