Fog Ransomware
Fog Ransomware is a cybercrime syndicate with a financial motive, tracked by Brandefense. It targets 11 sectors, including Government and Technology, in 16 countries, including the United States and India. It uses 9 MITRE ATT&CK techniques and exploits 16 known CVEs.
- Techniques
- 9
- Exploited CVEs
- 16
- First seen
- Apr 1, 2024
- Last seen
- Mar 1, 2025
- Record updated
Who They Target.
About Fog Ransomware.
Fog ransomware is a cybercriminal operation that emerged in April 2024, employing double extortion tactics (encryption + data exfiltration) against organizations across multiple sectors. Initially targeting education and recreation sectors in the United States, the group rapidly expanded to technology, manufacturing, government, healthcare, retail, transportation, and financial services. The operation targets both Windows and Linux endpoints, uses file extensions.fog,.Fog, and.FLOCKED, and operates a Tor-based data leak site branded as "The Fog Blog." Fog actors leverage compromised VPN credentials (particularly SonicWall), vulnerability exploitation (e.g., Veeam CVE-, SonicWall CVE-, Zerologon CVE-2020-1472), and phishing campaigns for initial access. Tools observed include Cobalt Strike, Mimikatz, AnyDesk, Sliver C2, and MEGAsync for data exfiltration. As of April 2025, the group had claimed approximately 189 victims globally across 15+ countries. Researchers have noted links to Akira ransomware through shared infrastructure and similar TTPs, and potential connections to the Conti family through cryptocurrency wallet overlaps.
Last updated Sep 30, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.