Fox-IT / NCC Group blog
Three Lazarus RATs coming for your cheese (PondRAT, ThemeForestRAT, RemotePE incident response cases) · 2025-09-01T13:00:00+00:00
In the past few years, Fox-IT and NCC Group have conducted multiple incident response cases involving a Lazarus subgroup that specifically targets organizations in the financial and cryptocurrency sector. This Lazarus subgroup overlaps with activity linked to AppleJeus 1 , Citrine Sleet 2 , UNC4736 3 , and Gleaming Pisces 4 .