Fileless Malware

North Korea's Lazarus Group uses RemotePE, a fileless RAT that executes entirely in RAM, to target DeFi platforms. The group has stolen $577M in crypto this year alone.

Multi-stage malware campaign uses Python loaders and Early Bird APC injection to deploy encrypted RATs. TryCloudflare tunnels mask C2 infrastructure.

Securonix uncovers multi-stage fileless campaign using IPFS-hosted VHD files and process injection into signed Windows binaries to deploy AsyncRAT.