Good, I have enough. Let me break this down from an offensive perspective.
1. Lazarus RemotePE RAT — Kill Chain Analysis
(a) Execution Mechanics — How Fileless Actually Works
Look, "fileless" doesn't mean magic. It means the payload never hits disk in a recoverable form. According to the reporting, RemotePE follows a three-stage loader chain:
DPAPILoader → RemotePELoader → RemotePE in memory
The execution path works like this:
Stage 0: DPAPILoader — This is your initial foothold. Likely delivered via spear-phishing (Lazarus loves macro docs or LNK files). The loader uses Windows Data Protection API (DPAPI) for environmental keying — that means it binds decryption to the victim machine. Without the victim's DPAPI master keys, you can't statically analyze the payload. Smart tradecraft.
Stage 1: RemotePELoader — Fetches RemotePE from C2. This is where the "memory-only" part starts. The loader allocates executable memory, decrypts the payload in-place, and hands off execution.
Stage 2: RemotePE — Written in C++, operates in process space. No PE file on disk means no file hash for AV, no static signatures, no disk forensics.
What's the persistence mechanism? This is where you need to look beyond the marketing. If it's truly memory-only, it doesn't survive reboots — unless there's a separate persistence mechanism (scheduled task, registry run key, WMI event subscription) that re-triggers the loader chain. The reports don't clarify this yet.
(b) EDR/Detection Gaps
Here's where defenders get uncomfortable:
- No file artifacts = no hash-based detection, no YARA scans on disk
- DPAPI-keyed payloads = replay attacks won't work; every sample is theoretically unique per victim
- In-memory C2 retrieval = network indicators are the only pre-execution signal
- Process hollowing or process injection — the RAT needs a legitimate host process; if it uses
svchost or explorer, EDRs that rely on parent-child relationships may miss it
Critical gap: Many EDRs still under-weight memory-only execution. If the chain uses NtAllocateVirtualMemory with PAGE_EXECUTE_READWRITE followed by CreateRemoteThread, that's detectable — but the timing matters. If RemotePE uses more sophisticated techniques like thread hijacking or APC injection (Lazarus historically uses these), detection becomes noise-heavy.
(c) Observable Artifacts — What's Actually Detectable
Forget "fileless" — nothing is invisible. Hunt for:
Anomalous memory allocations — PAGE_EXECUTE_READWRITE in processes that shouldn't have it (browsers, Office apps, PDF readers). Look for executable memory regions without corresponding disk-mapped modules.
Process anomalies — Parent-child relationships where winword.exe spawns powershell.exe which then injects into svchost.exe. Or better: rundll32.exe with no command-line arguments (classic Lazarus TTP).
Network beaconing — The reports mention hard-coded C2. Even if the payload is memory-only, the C2 comms follow patterns. Look for:
- HTTPS to non-standard domains with JA3/JA3S fingerprints
- Beaconing intervals (Lazarus typically uses 30-60 second heartbeats)
- User-Agent strings that don't match the host process
DPAPI artifacts — Unusual CryptProtectData / CryptUnprotectData calls outside of expected Windows processes. DPAPI abuse is rare enough to be a high-fidelity signal.
Bottom line: RemotePE is sophisticated but not novel. It's Lazarus leveling up their tradecraft for high-value targets who have decent EDR. The DPAPI keying is the real innovation here — it forces incident responders to recover keys from the live system or LSASS dump to analyze the payload.
2. Ghost CMS ClickFix Campaign — Technical Breakdown
(a) SQLi-to-JavaScript-Injection Chain
OK, so here's the kill chain:
CVE-2026-26980 — Unauthenticated SQLi in Ghost's Content API. CVSS 9.4. Affects Ghost 3.24.0 through 6.19.0. Patch was released February 19; disclosure was February 20. We're in late May and 700+ domains are still exploited.
Admin API key extraction — The SQLi allows arbitrary database reads. Ghost stores admin API keys in the database. Attacker extracts these keys.
Ghost Admin API abuse — With the keys, attacker uses Ghost's legitimate Admin API to modify site content. They inject malicious JavaScript at the bottom of pages.
This is elegant. The attacker didn't need RCE on the server — they just needed to read the database. Then they used Ghost's own publishing workflow to serve their payload. The JavaScript is served from the legitimate domain, so same-origin policies don't block it, and domain reputation checks pass.
The JavaScript loader does fingerprinting — visitor filtering based on:
- User-Agent (likely Windows targets only)
- Geolocation
- Maybe previous visit history to avoid repeat serving
Qualified visitors get served the ClickFix lure.
(b) ClickFix Lure — What Gets Delivered
The ClickFix technique isn't new, but the scale here is. Here's how it works:
Step 1: Visitor sees a fake "Cloudflare human verification" page. Looks legit — Cloudflare branding, captcha-style layout.
Step 2: The "verification" instructs the user to:
- Open Windows Command Prompt
- Paste a pre-written command
- Hit Enter
Step 3: The command usually does something like:
powershell -enc <base64 encoded payload>
Or it might drop a batch file that fetches and executes a second-stage payload.
What's the final payload? The reports don't name specific malware families, but ClickFix campaigns historically deliver:
- Information stealers (RedLine, Lumma, Stealc)
- Crypters/loaders that fetch additional payloads
- RATs for persistent access
Given the victim profile (universities, AI companies, fintech), I'm betting on information stealers targeting credentials and cookies, with potential for follow-up access brokering.
(c) Competing Actor Clusters — Operational Reality
This is the interesting part. The XLab report confirms at least two distinct threat actor clusters have been observed re-infecting and competing for control.
What does "competing actor clusters" mean operationally?
Different tooling — One cluster might use JavaScript loader variant A, another uses variant B. Different C2 infrastructure. Different ClickFix command patterns.
Same entry point, different payloads — Both exploit CVE-2026-26980, but they're not coordinating. They're both harvesting the same admin API keys from the same vulnerable sites.
Re-infection battles — Cluster A compromises a site, injects their JS. Cluster B discovers the same site, extracts the API key, and replaces Cluster A's injection with their own. Or they might be fighting over the same stolen credentials pool.
Possible infrastructure sharing or theft — If Cluster B is seeing Cluster A's JavaScript, they might be actively monitoring the same GitHub repos, Pastebin drops, or C2 channels.
Operational implication: The victims aren't just dealing with one threat actor — they're dealing with a feeding frenzy. Multiple groups are exploiting the same vuln, and the re-infection rate means cleanup is harder than just patching Ghost. You also need to rotate all admin API keys, review staff accounts (because the SQLi gave DB read access — who knows what else they saw?), and check for any persistence mechanisms beyond the JavaScript injection.
Synthetic Assessment
RemotePE: Lazarus investing in memory-only tradecraft is expected for their high-value targeting. The DPAPI keying is the standout TTP here — it raises the cost of incident response significantly. This isn't a mass-market tool; this is reserved for targets where they expect mature EDR and skilled defenders.
Ghost CMS ClickFix: CVSS 9.4, unauthenticated, public exploit PoC on GitHub since February, 700+ domains still compromised in May. This is systemic patching failure masquerading as a sophisticated campaign. The ClickFix social engineering works because it bypasses technical controls entirely — the malware never touches the victim's defenses; the victim downloads it themselves. The competing actor clusters suggest the initial access is commoditized now. Ghost CMS sites are effectively a shared watering hole for multiple crimeware groups.
Combined takeaway: Attackers are bifurcating their approaches — high-sophistication, high-cost tradecraft (RemotePE) for specific high-value targets, and low-cost, scalable access exploitation (Ghost ClickFix) for volume credential theft. Both are effective in their lanes.