Fog
Fog is a ransomware group with a financial motive, tracked by Brandefense. It targets 17 sectors, including Government and Technology, in 35 countries, including the United States and the United Kingdom. It uses 26 MITRE ATT&CK techniques and exploits 16 known CVEs.
Also known as
- fog Team
- Techniques
- 26
- Exploited CVEs
- 16
- First seen
- Jun 1, 2024
- Last seen
- Apr 28, 2025
- Record updated
Who They Target.
Sectors · 17
Countries · 35
Labelsglobalransomware
About Fog.
Fog, which uses the.flocked extension for encrypted files, was first observed in May in campaigns by Storm-0844, a threat actor known for distributing Akira. By June, Storm-0844 was deploying Fog more than Akira.
Last updated Oct 1, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.