Fox-IT International blog

RemotePE: The Lazarus RAT that lives in memory

Authors: Yun Zheng Hu and Mick Koomen Summary Last year, we published research about a North Korean Lazarus subgroup targeting financial and cryptocurrency organizations, encountered during multiple incident response engagements. This Lazarus subgroup overlaps with activity linked to AppleJeus, Citrine Sleet, UNC4736, and Gleaming Pisces. In one investigation, we observed that the actor had replaced … <a href="https://blog.fox-it.com/2026/05/22/remotepe-the-lazarus-rat-that-lives-in-memory/" class="more-link">Continue reading RemotePE: The Lazarus RAT that lives in memory →</a>

2026/5/22

Three Lazarus RATs coming for your cheese

Authors: Yun Zheng Hu and Mick Koomen Introduction In the past few years, Fox-IT and NCC Group have conducted multiple incident response cases involving a Lazarus subgroup that specifically targets organizations in the financial and cryptocurrency sector. This Lazarus subgroup overlaps with activity linked to AppleJeus, Citrine Sleet, UNC4736, and Gleaming Pisces. This actor uses … <a href="https://blog.fox-it.com/2025/09/01/three-lazarus-rats-coming-for-your-cheese/" class="more-link">Continue reading Three Lazarus RATs coming for your cheese →</a>

2025/9/1

Decrypting Full Disk Encryption with Dissect

Author: Guus Beckers Back in 2022 Fox-IT decided to open source its proprietary incident response tooling known as Dissect. Since then it has been adopted by many different companies in their regular workflow. For those of you who are not yet familiar with Dissect, it is an incident response framework built with incident response engagements of any … <a href="https://blog.fox-it.com/2024/12/11/decrypting-full-disk-encryption-with-dissect/" class="more-link">Continue reading Decrypting Full Disk Encryption with Dissect →</a>

2024/12/11

Red Teaming in the age of EDR: Evasion of Endpoint Detection Through Malware Virtualisation

Authors: Boudewijn Meijer && Rick Veldhoven Introduction As defensive security products improve, attackers must refine their craft. Gone are the days of executing malicious binaries from disk, especially ones well known to antivirus and Endpoint Detection and Reponse (EDR) vendors. Now, attackers focus on in-memory payload execution for both native and managed applications to evade … <a href="https://blog.fox-it.com/2024/09/25/red-teaming-in-the-age-of-edr-evasion-of-endpoint-detection-through-malware-virtualisation/" class="more-link">Continue reading Red Teaming in the age of EDR: Evasion of Endpoint Detection Through Malware Virtualisation →</a>

2024/9/25

Sifting through the spines: identifying (potential) Cactus ransomware victims

Authored by Willem Zeeman and Yun Zheng Hu This blog is part of a series written by various Dutch cyber security firms that have collaborated on the Cactus ransomware group, which exploits Qlik Sense servers for initial access. To view all of them please check the central blog by Dutch special interest group Cyberveilig Nederland … <a href="https://blog.fox-it.com/2024/04/25/sifting-through-the-spines-identifying-potential-cactus-ransomware-victims/" class="more-link">Continue reading Sifting through the spines: identifying (potential) Cactus ransomware victims →</a>

2024/4/25

Android Malware Vultur Expands Its Wingspan

Authored by Joshua Kamp Executive summary The authors behind Android banking malware Vultur have been spotted adding new technical features, which allow the malware operator to further remotely interact with the victim’s mobile device. Vultur has also started masquerading more of its malicious activity by encrypting its C2 communication, using multiple encrypted payloads that are … <a href="https://blog.fox-it.com/2024/03/28/android-malware-vultur-expands-its-wingspan/" class="more-link">Continue reading Android Malware Vultur Expands Its Wingspan →</a>

2024/3/28

Memory Scanning for the Masses

Authors: Axel Boesenach and Erik Schamper In this blog post we will go into a user-friendly memory scanning Python library that was created out of the necessity of having more control during memory scanning. We will give an overview of how this library works, share the thought process and the why’s. This blog post will … <a href="https://blog.fox-it.com/2024/01/25/memory-scanning-for-the-masses/" class="more-link">Continue reading Memory Scanning for the Masses →</a>

2024/1/25

Reverse, Reveal, Recover: Windows Defender Quarantine Forensics

Max Groot & Erik Schamper TL;DR Introduction During incident response engagements we often encounter antivirus applications that have rightfully triggered on malicious software that was deployed by threat actors. Most commonly we encounter this for Windows Defender, the antivirus solution that is shipped by default with Microsoft Windows. Windows Defender places malicious files in quarantine … <a href="https://blog.fox-it.com/2023/12/14/reverse-reveal-recover-windows-defender-quarantine-forensics/" class="more-link">Continue reading Reverse, Reveal, Recover: Windows Defender Quarantine Forensics →</a>

2023/12/14

The Spelling Police: Searching for Malicious HTTP Servers by Identifying Typos in HTTP Responses

Authored by Margit Hazenbroek At Fox-IT (part of NCC Group) identifying servers that host nefarious activities is a critical aspect of our threat intelligence. One approach involves looking for anomalies in responses of HTTP servers. Sometimes cybercriminals that host malicious servers employ tactics that involve mimicking the responses of legitimate software to evade detection. However, … <a href="https://blog.fox-it.com/2023/11/15/the-spelling-police-searching-for-malicious-http-servers-by-identifying-typos-in-http-responses/" class="more-link">Continue reading The Spelling Police: Searching for Malicious HTTP Servers by Identifying Typos in HTTP Responses →</a>

2023/11/15

Popping Blisters for research: An overview of past payloads and exploring recent developments

Authored by Mick Koomen Summary Blister is a piece of malware that loads a payload embedded inside it. We provide an overview of payloads dropped by the Blister loader based on 137 unpacked samples from the past one and a half years and take a look at recent activity of Blister. The overview shows that … <a href="https://blog.fox-it.com/2023/11/01/popping-blisters-for-research-an-overview-of-past-payloads-and-exploring-recent-developments/" class="more-link">Continue reading Popping Blisters for research: An overview of past payloads and exploring recent developments →</a>

2023/11/1

Fox-IT International blog

RemotePE: The Lazarus RAT that lives in memory

Three Lazarus RATs coming for your cheese

Decrypting Full Disk Encryption with Dissect

Red Teaming in the age of EDR: Evasion of Endpoint Detection Through Malware Virtualisation

Sifting through the spines: identifying (potential) Cactus ransomware victims

Android Malware Vultur Expands Its Wingspan

Memory Scanning for the Masses

Reverse, Reveal, Recover: Windows Defender Quarantine Forensics

The Spelling Police: Searching for Malicious HTTP Servers by Identifying Typos in HTTP Responses

Popping Blisters for research: An overview of past payloads and exploring recent developments

推荐订阅

Threat Intelligence

Cofense

Google Android Security Bulletins

Adobe Security Bulletins and Advisories

VirusTotal Blog