Fox-IT International Blog (NCC Group)

https://blog.fox-it.com/

Fox-IT (NCC Group subsidiary) DFIR primary disclosures; distinct property from ncc-research (nccgroup.com/research-blog). Surfaced by S1/S3 as the primary for the Lazarus RemotePE memory-only RAT teardown (2026-05-22). Candidate — promote to active after 3 runs with content contribution. | 2026-06-20 full audit (v2.62): live=Y, drill=Y. FETCH → webfetch https://blog.fox-it.com/ (then webfetch per-post URL for body). AVOID: Nothing blocks it. Very low cadence (3 posts in ~18 months) — empty window is normal, not a failure.. | 2026-07-05 admiralty audit: B — original NCC/Fox-IT DFIR research; no status change (active). Very low cadence (3 posts in ~18 months) — empty window is expected, not a failure.