Fox-IT

@foxit

IT-Security company creating special security, intelligence and forensics solutions. Fox-IT is part of NCC Group.

Delft, The Netherlands

fox-it.com

Replies Reposts Media

Fox-IT
@foxit
Dec 4, 2025
Dissect update Say hello to Dissect version 3.21 - Minimum Python version is now 3.10 - New dissect.apfs project – initial support for macOS, available through the API - Improved usability for interacting with nested targets - Support for CramFS and Apple Sparse Image Format
Fox-IT
@foxit
Sep 12, 2025
Sharing is caring! We've uploaded malware samples from our latest Lazarus research to VirusTotal (d86c51db1a0f3c6b71b1b62a766d6daa). This includes macOS, Linux and Windows samples used by this actor, such as custom screenshotters and keyloggers. See our blogpost for the hashes:
Three Lazarus RATs coming for your cheese
From blog.fox-it.com
Fox-IT
@foxit
Sep 11, 2025
𝗡𝗲𝘄 𝗗𝗶𝘀𝘀𝗲𝗰𝘁 𝗿𝗲𝗹𝗲𝗮𝘀𝗲 𝘃.𝟯.𝟮𝟬.𝟭 𝗶𝘀 𝗼𝘂𝘁! Important: deprecation notice for Python 3.9, next Dissect version will support Python 3.10 and up - VMFS implementation rewritten from scratch - Mounting btrfs subvolumes with target-mount enabled - Performance
Fox-IT
@foxit
Sep 1, 2025
🧀 𝗡𝗲𝘄 𝗯𝗹𝗼𝗴: "𝗧𝗵𝗿𝗲𝗲 𝗟𝗮𝘇𝗮𝗿𝘂𝘀 𝗥𝗔𝗧𝘀 𝗖𝗼𝗺𝗶𝗻𝗴 𝗳𝗼𝗿 𝗬𝗼𝘂𝗿 𝗖𝗵𝗲𝗲𝘀𝗲" Read about PondRAT, ThemeForestRAT and RemotePE - three RATs we encountered during incident response involving the Lazarus group. Check the indicators and don't let them steal
Three Lazarus RATs coming for your cheese
From blog.fox-it.com
Fox-IT
@foxit
Dec 11, 2024
🔒Great news for #DFIR folks! Dissect now supports both BitLocker & LUKS encrypted disks, making forensic analysis smoother and more comprehensive. Another step forward for digital forensics capabilities! Read more in this blog: blog.fox-it.com/2024/12/11/dec… #InfoSec #DigitalForensics