Do Son Fox-IT uncovers a sophisticated Lazarus memory-only toolset used to compromise financial firms via an evasive three-stage malware pipeline.
RemotePE
A new report reveals a Lazarus Group subgroup is using a tiered arsenal of custom RATs—PondRAT, ThemeForestRAT, and RemotePE—to target the financial and crypto sectors.