Fog

Compare
fog logo fog logo
Parsing: enabled

View crypto

Description

Fog is a sophisticated ransomware strain first observed in April–May 2024, initially targeting U.S. educational institutions before expanding into sectors such as government, business services, finance, and manufacturing. The group conducts fast, double-extortion attacks: they exploit compromised VPN credentials or known vulnerabilities, deploy encryption (notably using extensions like .fog, .FLOCKED), and exfiltrate data prior to encryption to maximize victim pressure. Fog is associated with other prolific actors—such as Akira and Conti—through shared tooling, infrastructure timelines, and even cryptocurrency wallets.

External Analysis8
External Analysis
https://www.kroll.com/en/publications/cyber/fog-ransomware-targets-higher-education
https://www.broadcom.com/support/security-center/protection-bulletin/fog-ransomware
https://www.sentinelone.com/anthology/fog/
https://blog.barracuda.com/2025/04/29/a-closer-look-at-fog-ransomware
https://www.trendmicro.com/en_us/research/25/d/fog-ransomware-concealed-within-binary-loaders-linking-themselve.html
https://www.securitymagazine.com/articles/101694-fog-ransomware-group-uses-unconventional-toolset-new-research-finds
https://www.areteir.com/static/FOG_Ransomware.pdf
https://assets.kpmg.com/content/dam/kpmgsites/in/pdf/2024/11/kpmg-ctip-fog-ransomware-19-nov-2024.pdf.coredownload.inline.pdf
Ransom notes2
Urls2
Url
Status
Screen
Uptime 30d
Health
http://xbkv2qey6u3gd3qxcojynrt4h5sgrhkar6whuo74wo63hijnn677jnyd.onion Down Screen
http://xbkv2qey6u3gd3qxcojynrt4h5sgrhkar6whuo74wo63hijnn677jnyd.onion/posts Down Screen
File servers3
Url
Status
Screen
Uptime 30d
Health
http://hlbqbuy2bo3onn6h6eq7pbci24kughiaw4rkxrewidnqma3hwwgt2ead.onion Down Screen
http://44dz7r5uduhihaks7m62vztthp5s7thokbgeida7usm4rvakriuvk3yd.onion/ Down Screen
0%
http://nw5zrjqarckmsf22rrgo5yooelpnn5raxhesuhrpzceqibmjwanbbaad.onion/ Down Screen
0%
Chat servers1
Url
Status
Screen
Uptime 30d
Health
https://xql562evsy7njcsngacphc2erzjfecwotdkobn3m4uxu2gtqh26newid.onion/ Down Screen
0%
Activity (interactive) 134
Activity charts
Posts134
Date Title Description Screen
Newtown Friends School (newtownfriends.org)
RAE (Real Academia Española) (rae.es) <1 GB Post screen
University Diagnostic Medical Imaging, PC (udmi.net) 28.1 GB Post screen
El Camino Real Academy (elcaminorealacademy) 111 GB Post screen
Wilkinson Rogers (wilkinsonrogers.com) 57 GB Post screen
Magnolia Manor (magnoliamanor.com) 54.6 GB Post screen
Oberlin Cable Co-op (oberlin.net) 33 GB Post screen
WJCC Public Schools (wjccschools.org) 27.7 GB Post screen
The 19 biggest gitlabs Post screen
SCOLARO FETTER GRIZANTI & McGOUGH, P.C. (scolaro.com) 92.5 GB Post screen
Grupo Baston Aerossol (baston.com.br) 88.3 GB Post screen
Pampili (pampili.com.br) 36.3 GB Post screen
Central McGowan (centralmcgowan.com) 23.5 GB Post screen
Klesk Metal Stamping Co (kleskmetalstamping.com) 2.2 GB Post screen
Gitlabs: Synelixis Solutions, INGV, VMO Holdings Post screen
Gitlabs: Naphix, WDNA, Bayteq Post screen
Haggin Oaks Golf (hagginoaks.com) 29,2 GB Post screen
Gitlabs: Next TI, VISEO, Hochschule Trier Post screen
Greencastle-Antrim Senior High School (gcasd.org) 7.6 GB Post screen
Gitlabs: Acqua development, QBurst, Pamyra.de Post screen
Gitlabs: Omydoo, Ayomi, ADULLACT Post screen
Mozo Grau (mozo-grau.com) 72.2 Post screen
The University of Notre Dame Australia (nd.edu.au) 62 GB Post screen
Aurora Public Schools (aurorak12.org) 171 GB Post screen
Saint George's College (saintgeorge.cl) 5 GB Post screen
Hess (hess-gmbh.de) 6.5 GB Post screen
Gitlabs: INGV, Spacemanic, Squeezer-software Post screen
Gitlabs: Universitatea Politehnica din Bucuresti, Maxvy Technologies Pvt, iRidge Inc. Post screen
Gitlabs: Chalmers tekniska högskola, Fligno, 3SS Post screen
Gitlabs: eConceptions, Top Systems, DIEM Post screen
Gitlabs: hemio.de, SOLEIL, Devlion Post screen
Gitlabs: Bolin Centre for Climate Research, X-lab group, Madia Post screen
Karadeniz Holding (karadenizholding.com) 1.5 TB Post screen
Gitlabs: PT. ITPRENEUR INDONESIA TECHNOLOGY, GFZ Helmholtz Centre for Geosciences, LUA Cof
Gitlabs: Professional Computer, X-Pans, Propulsion Academy AG Post screen
Gitlabs: Prasaga, HE2B, Kombinat Post screen
Boutin Jones (boutindentino.com) 180 GB Post screen
ELTEK Group (eltekgroup.com) 13 GB Post screen
De La Salle High School (dlshs.org) 20 GB Post screen
Kooijman Vianen (kooijmanvianen.nl) 25.7 GB Post screen
SciTech Services, Inc. 15 GB Post screen
Buttery (butterycompany.com) 1.7 GB Post screen
The University of Oklahoma (ou.edu) 91 MB Post screen
OmniRide (omniride.com) 7.2 GB Post screen
Saint-Bar (saintbar.be) 16.8 GB Post screen
Ober Mountain (OberGatlinburg.com) 14.3 GB Post screen
Aroma Housewares Co (Aromaco.com) 35 GB Post screen
RODS Surveying (rods.cc) 43.5 GB Post screen
Forum Architecture & Interior Design (forumarchitecture.com) 5.7 GB Post screen
Gallade Chemical (galladechem.com) 2.4 GB Post screen
Industria e Comercio Jolitex Ltda (jolitex.com) 23 GB Post screen
Village Community School (vcsnyc.org) 1 GB Post screen
Circle Electric (circleelectric.com) 25.9 GB Post screen
EP Holdings (epholdingsinc.com) 2.7 GB Post screen
Schenkelberg - Die Medienstrategen (schenkelberg-druck.de) 6.8 GB Post screen
Howell Township Public Schools (howell.k12.nj.us) 14.2 GB Post screen
Energy Capital Credit Union (eccu.net) Post screen
Jet Edge (jetedgewaterjets.com) 5 GB Post screen
Reliance Connects (relianceconnects.com) 19 GB Post screen
Vroninks Ricker Weyts & Sacre- Notaires (notassoc.be) 15 GB Post screen
SpeedLine Solutions (speedlinesolutions.com) 6 GB Post screen
Ouro Verde (ouroverde.net.br) 4 GB Post screen
Waverley Christian College (wcc.vic.edu.au) 5 GB Post screen
Cognity (cognity.gr) 36 GB Post screen
Planters Telephone Cooperative (planters.net) about 1 GB Post screen
Dorner (dorner-gmbh.de) 1 GB Post screen
Conlin's Pharmacy (conlinspharmacy.com) 10 GB Post screen
Weld Racing (weldracing.com) 10,1 GB Post screen
Chanas Assurances S.A. (chanasassurances.com) 6 GB Post screen
ALLTUB Group (alltub.com) 20 GB Post screen
Bedminster School (bedminsterschool.org) Post screen
WPM Pathology Laboratory (wpmpath.com) 3 GB Post screen
Gruber Tool & Die (grubertool.com) 8,2 GB Post screen
Signal Health Washington (signalhealthwa.com) 1 GB Post screen
Complete Recycling Services (completerecyclingservices.com) 1,4 GB Post screen
Pinnacle Plastic Products (pinnacleplasitcporducts.com) 5,3 GB Post screen
Pioneer Urban Land & Infrastructure (pioneerurban.in) 10 GB Post screen
Marketing Incentives (leinsterappointments.ie) about 1 GB Post screen
Metroline (metrolinedirect.com) 1,3 GB Post screen
Fifteenfortyseven Critical Systems Realty (1547realty.com) 6 GB Post screen
Hogan Mfg (hoganmfg.com) 10,5 GB Post screen
Burkburnett Independent School District 1 GB Post screen
Valley Planing Mill (valleyplaning.com) 5,6 GB Post screen
Waters Truck and Tractor (waterstruck.com) 3 GB Post screen
Vector Transport (vectortransport.com) 19 GB Post screen
Cape Cod Regional Technical High School (capetech.us) 6 GB Post screen
GSR Andrade Architects (gsr-andrade.com) 65 GB Post screen
Askling Car (asklingbil.se) 2,6 GB Post screen
Jillamy (jillamy.com) 28 GB Post screen
SmartSource (smartsource-inc.com) 81 GB Post screen
Jordan Public Schools (https://www.jordan.k12.mn.us/) 11 GB Post screen
Sage Automotive Interior (sageautomotiveinteriors.com) 76 GB Post screen
Evergreen SD50 (evergreensd50.com) 5,1 GB Post screen
Evergreen Public Schools (evergreenps.org) 5,1 GB Post screen
Evergreen Local School District (evgvikings.org) 5,1 GB Post screen
Cucamonga Valley Water District (cvwdwater.com) 41 GB Post screen
Value City NJ (valuecitynj.com) 25 GB Post screen
The Getz Group (getz.com.hk) 45 GB Post screen
Apache Mills, Inc. (apachemills.com) 27 GB Post screen
Goshen Central School District (gcsny.org) 10 GB Post screen
Mar-Bal (mar-bal.com) 37 GB Post screen
Lincoln University (lincolnu.edu) 10 GB Post screen
Clear Connection (clearconnection.com) 71 GB Post screen
Trimarc Financial (trimarc.com) 3 GB Post screen
Philadelphia Macaroni (philamacaroni.com) 102 GB Post screen
Schweiger Transport (schweiger-gmbh.de) 118 GB Post screen
Fromm (FrommBeauty.com) 16 GB Post screen
Ultra Tune (ultratune.com.au) 3 GB Post screen
Welker (welker.com) 27,6 GB Post screen
Cordogan Clark and Associates (cordoganclark.com) 107 GB Post screen
Food Sciences Corporation (foodsciences.com) 86 GB Post screen
Central Pennsylvania Food Bank 20 GB Post screen
Juice Generation 10 GB Post screen
Sunrise Farms 30 GB Post screen
Prentke Romich Company 250 GB Post screen
S. Walter Packaging Post screen
Clatronic International GmbH 469 GB Post screen
Seaway Manufacturing Corp. Post screen
Ziba Design 22 GB Post screen
IOI Corporation Berhad 20 GB Post screen
Hi-P International 22 GB Post screen
unknown 0
BASF | Nunhems 30 GB Post screen
City of Cold Lake 10 GB Post screen
Odessa College 18 GB Post screen
00 0 Post screen
Wichita State University Campus of Applied Sciences and Technology 10 GB Post screen
Geelong Lutheran College 4GB Post screen
Asbury Theological Seminary 10 GB Post screen
Djg Projects 19.4GB Post screen
Verweij Elektrotechniek 95GB Post screen
Alvin Independent School District 60GB Post screen
West Allis-West Milwaukee School District 9,5 GB Post screen
German University of Technology in Oman 10 GB Post screen
Note