fog Ransomware
Tracked since Jul 16, 2024
0
victims recorded
0
in the last 30 days
0
CVEs
—
Last activity
Fog, which uses the .flocked extension for encrypted files, was first observed in May in campaigns by Storm-0844, a threat actor known for distributing Akira. By June, Storm-0844 was deploying Fog more than Akira.
Vulnerabilities cited for this group
CVEs associated with the group by ransomware.live. Records not yet published here appear without a link.
No CVE associated with this group in the sources.
Observed tools
Credential Theft
DonPAPI · Veeam-Get-Creds
Discovery Enum
Advanced Port Scanner · SharpShares · SoftPerfect NetScan
LOLBAS
PsExec
Networking
Powercat · Proxychains
Offsec
Certipy · Impacket · Metasploit · NetExec · Orpheus · Sliver · Zer0dump
RMM-Tools
AnyDesk
Victims posted on leak sites, according to ransomware.live. Victim names are not displayed. · View on ransomware.live