Deep Dive: 3 Lazarus RATs Caught in Our DNS Trap

Fox-IT and the NCC Group investigated a Lazarus subgroup linked to AppleJeus, Citrine Sleet, UNC47363, and Gleaming Pisces and uses different remote access Trojans (RATs) known as “PondRAT5,” “ThemeForestRAT,” and “RemotePE.”

The researchers specifically analyzed the three RATs in great depth and identified 19 domains and two IP addresses as indicators of compromise (IoCs) in the process.

WhoisXML API dug deeper into the three RATs’ DNS infrastructure, which led to these discoveries:

• One unique client IP communicated with one unique domain IoC
• Two unique potential victim IPs communicated with two unique IP IoCs
• One domain IoC was dubbed likely to turn malicious 189 days before being tagged as such
• One email-connected domain
• Nine additional IP addresses, eight were malicious
• 57 IP-connected domains
• 259 string-connected domains

Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.

—

• [1] https://blog.fox-it.com/2025/09/01/three-lazarus-rats-coming-for-your-cheese/