Fog
Compare
Parsing: enabled
Description
Fog is a sophisticated ransomware strain first observed in April–May 2024, initially targeting U.S. educational institutions before expanding into sectors such as government, business services, finance, and manufacturing. The group conducts fast, double-extortion attacks: they exploit compromised VPN credentials or known vulnerabilities, deploy encryption (notably using extensions like .fog, .FLOCKED), and exfiltrate data prior to encryption to maximize victim pressure. Fog is associated with other prolific actors—such as Akira and Conti—through shared tooling, infrastructure timelines, and even cryptocurrency wallets.
External Analysis8
| External Analysis |
|---|
| https://www.kroll.com/en/publications/cyber/fog-ransomware-targets-higher-education |
| https://www.broadcom.com/support/security-center/protection-bulletin/fog-ransomware |
| https://www.sentinelone.com/anthology/fog/ |
| https://blog.barracuda.com/2025/04/29/a-closer-look-at-fog-ransomware |
| https://www.trendmicro.com/en_us/research/25/d/fog-ransomware-concealed-within-binary-loaders-linking-themselve.html |
| https://www.securitymagazine.com/articles/101694-fog-ransomware-group-uses-unconventional-toolset-new-research-finds |
| https://www.areteir.com/static/FOG_Ransomware.pdf |
| https://assets.kpmg.com/content/dam/kpmgsites/in/pdf/2024/11/kpmg-ctip-fog-ransomware-19-nov-2024.pdf.coredownload.inline.pdf |
Ransom notes2
Urls2
| Url | ||||
|---|---|---|---|---|
| http://xbkv2qey6u3gd3qxcojynrt4h5sgrhkar6whuo74wo63hijnn677jnyd.onion | Down |
|
||
| http://xbkv2qey6u3gd3qxcojynrt4h5sgrhkar6whuo74wo63hijnn677jnyd.onion/posts | Down |
|
File servers3
| Url | ||||
|---|---|---|---|---|
| http://hlbqbuy2bo3onn6h6eq7pbci24kughiaw4rkxrewidnqma3hwwgt2ead.onion | Down |
|
||
| http://44dz7r5uduhihaks7m62vztthp5s7thokbgeida7usm4rvakriuvk3yd.onion/ | Down |
|
||
| http://nw5zrjqarckmsf22rrgo5yooelpnn5raxhesuhrpzceqibmjwanbbaad.onion/ | Down |
|
Chat servers1
| Url | ||||
|---|---|---|---|---|
| https://xql562evsy7njcsngacphc2erzjfecwotdkobn3m4uxu2gtqh26newid.onion/ | Down |
|
Activity (interactive) 134
Posts134
| Date | Title | Description | Screen |
|---|---|---|---|
| Newtown Friends School (newtownfriends.org) | |||
| RAE (Real Academia Española) (rae.es) | <1 GB |
|
|
| University Diagnostic Medical Imaging, PC (udmi.net) | 28.1 GB |
|
|
| El Camino Real Academy (elcaminorealacademy) | 111 GB |
|
|
| Wilkinson Rogers (wilkinsonrogers.com) | 57 GB |
|
|
| Magnolia Manor (magnoliamanor.com) | 54.6 GB |
|
|
| Oberlin Cable Co-op (oberlin.net) | 33 GB |
|
|
| WJCC Public Schools (wjccschools.org) | 27.7 GB |
|
|
| The 19 biggest gitlabs |
|
||
| SCOLARO FETTER GRIZANTI & McGOUGH, P.C. (scolaro.com) | 92.5 GB |
|
|
| Grupo Baston Aerossol (baston.com.br) | 88.3 GB |
|
|
| Pampili (pampili.com.br) | 36.3 GB |
|
|
| Central McGowan (centralmcgowan.com) | 23.5 GB |
|
|
| Klesk Metal Stamping Co (kleskmetalstamping.com) | 2.2 GB |
|
|
| Gitlabs: Synelixis Solutions, INGV, VMO Holdings |
|
||
| Gitlabs: Naphix, WDNA, Bayteq |
|
||
| Haggin Oaks Golf (hagginoaks.com) | 29,2 GB |
|
|
| Gitlabs: Next TI, VISEO, Hochschule Trier |
|
||
| Greencastle-Antrim Senior High School (gcasd.org) | 7.6 GB |
|
|
| Gitlabs: Acqua development, QBurst, Pamyra.de |
|
||
| Gitlabs: Omydoo, Ayomi, ADULLACT |
|
||
| Mozo Grau (mozo-grau.com) | 72.2 |
|
|
| The University of Notre Dame Australia (nd.edu.au) | 62 GB |
|
|
| Aurora Public Schools (aurorak12.org) | 171 GB |
|
|
| Saint George's College (saintgeorge.cl) | 5 GB |
|
|
| Hess (hess-gmbh.de) | 6.5 GB |
|
|
| Gitlabs: INGV, Spacemanic, Squeezer-software |
|
||
| Gitlabs: Universitatea Politehnica din Bucuresti, Maxvy Technologies Pvt, iRidge Inc. |
|
||
| Gitlabs: Chalmers tekniska högskola, Fligno, 3SS |
|
||
| Gitlabs: eConceptions, Top Systems, DIEM |
|
||
| Gitlabs: hemio.de, SOLEIL, Devlion |
|
||
| Gitlabs: Bolin Centre for Climate Research, X-lab group, Madia |
|
||
| Karadeniz Holding (karadenizholding.com) | 1.5 TB |
|
|
| Gitlabs: PT. ITPRENEUR INDONESIA TECHNOLOGY, GFZ Helmholtz Centre for Geosciences, LUA Cof | |||
| Gitlabs: Professional Computer, X-Pans, Propulsion Academy AG |
|
||
| Gitlabs: Prasaga, HE2B, Kombinat |
|
||
| Boutin Jones (boutindentino.com) | 180 GB |
|
|
| ELTEK Group (eltekgroup.com) | 13 GB |
|
|
| De La Salle High School (dlshs.org) | 20 GB |
|
|
| Kooijman Vianen (kooijmanvianen.nl) | 25.7 GB |
|
|
| SciTech Services, Inc. | 15 GB |
|
|
| Buttery (butterycompany.com) | 1.7 GB |
|
|
| The University of Oklahoma (ou.edu) | 91 MB |
|
|
| OmniRide (omniride.com) | 7.2 GB |
|
|
| Saint-Bar (saintbar.be) | 16.8 GB |
|
|
| Ober Mountain (OberGatlinburg.com) | 14.3 GB |
|
|
| Aroma Housewares Co (Aromaco.com) | 35 GB |
|
|
| RODS Surveying (rods.cc) | 43.5 GB |
|
|
| Forum Architecture & Interior Design (forumarchitecture.com) | 5.7 GB |
|
|
| Gallade Chemical (galladechem.com) | 2.4 GB |
|
|
| Industria e Comercio Jolitex Ltda (jolitex.com) | 23 GB |
|
|
| Village Community School (vcsnyc.org) | 1 GB |
|
|
| Circle Electric (circleelectric.com) | 25.9 GB |
|
|
| EP Holdings (epholdingsinc.com) | 2.7 GB |
|
|
| Schenkelberg - Die Medienstrategen (schenkelberg-druck.de) | 6.8 GB |
|
|
| Howell Township Public Schools (howell.k12.nj.us) | 14.2 GB |
|
|
| Energy Capital Credit Union (eccu.net) |
|
||
| Jet Edge (jetedgewaterjets.com) | 5 GB |
|
|
| Reliance Connects (relianceconnects.com) | 19 GB |
|
|
| Vroninks Ricker Weyts & Sacre- Notaires (notassoc.be) | 15 GB |
|
|
| SpeedLine Solutions (speedlinesolutions.com) | 6 GB |
|
|
| Ouro Verde (ouroverde.net.br) | 4 GB |
|
|
| Waverley Christian College (wcc.vic.edu.au) | 5 GB |
|
|
| Cognity (cognity.gr) | 36 GB |
|
|
| Planters Telephone Cooperative (planters.net) | about 1 GB |
|
|
| Dorner (dorner-gmbh.de) | 1 GB |
|
|
| Conlin's Pharmacy (conlinspharmacy.com) | 10 GB |
|
|
| Weld Racing (weldracing.com) | 10,1 GB |
|
|
| Chanas Assurances S.A. (chanasassurances.com) | 6 GB |
|
|
| ALLTUB Group (alltub.com) | 20 GB |
|
|
| Bedminster School (bedminsterschool.org) |
|
||
| WPM Pathology Laboratory (wpmpath.com) | 3 GB |
|
|
| Gruber Tool & Die (grubertool.com) | 8,2 GB |
|
|
| Signal Health Washington (signalhealthwa.com) | 1 GB |
|
|
| Complete Recycling Services (completerecyclingservices.com) | 1,4 GB |
|
|
| Pinnacle Plastic Products (pinnacleplasitcporducts.com) | 5,3 GB |
|
|
| Pioneer Urban Land & Infrastructure (pioneerurban.in) | 10 GB |
|
|
| Marketing Incentives (leinsterappointments.ie) | about 1 GB |
|
|
| Metroline (metrolinedirect.com) | 1,3 GB |
|
|
| Fifteenfortyseven Critical Systems Realty (1547realty.com) | 6 GB |
|
|
| Hogan Mfg (hoganmfg.com) | 10,5 GB |
|
|
| Burkburnett Independent School District | 1 GB |
|
|
| Valley Planing Mill (valleyplaning.com) | 5,6 GB |
|
|
| Waters Truck and Tractor (waterstruck.com) | 3 GB |
|
|
| Vector Transport (vectortransport.com) | 19 GB |
|
|
| Cape Cod Regional Technical High School (capetech.us) | 6 GB |
|
|
| GSR Andrade Architects (gsr-andrade.com) | 65 GB |
|
|
| Askling Car (asklingbil.se) | 2,6 GB |
|
|
| Jillamy (jillamy.com) | 28 GB |
|
|
| SmartSource (smartsource-inc.com) | 81 GB |
|
|
| Jordan Public Schools (https://www.jordan.k12.mn.us/) | 11 GB |
|
|
| Sage Automotive Interior (sageautomotiveinteriors.com) | 76 GB |
|
|
| Evergreen SD50 (evergreensd50.com) | 5,1 GB |
|
|
| Evergreen Public Schools (evergreenps.org) | 5,1 GB |
|
|
| Evergreen Local School District (evgvikings.org) | 5,1 GB |
|
|
| Cucamonga Valley Water District (cvwdwater.com) | 41 GB |
|
|
| Value City NJ (valuecitynj.com) | 25 GB |
|
|
| The Getz Group (getz.com.hk) | 45 GB |
|
|
| Apache Mills, Inc. (apachemills.com) | 27 GB |
|
|
| Goshen Central School District (gcsny.org) | 10 GB |
|
|
| Mar-Bal (mar-bal.com) | 37 GB |
|
|
| Lincoln University (lincolnu.edu) | 10 GB |
|
|
| Clear Connection (clearconnection.com) | 71 GB |
|
|
| Trimarc Financial (trimarc.com) | 3 GB |
|
|
| Philadelphia Macaroni (philamacaroni.com) | 102 GB |
|
|
| Schweiger Transport (schweiger-gmbh.de) | 118 GB |
|
|
| Fromm (FrommBeauty.com) | 16 GB |
|
|
| Ultra Tune (ultratune.com.au) | 3 GB |
|
|
| Welker (welker.com) | 27,6 GB |
|
|
| Cordogan Clark and Associates (cordoganclark.com) | 107 GB |
|
|
| Food Sciences Corporation (foodsciences.com) | 86 GB |
|
|
| Central Pennsylvania Food Bank | 20 GB |
|
|
| Juice Generation | 10 GB |
|
|
| Sunrise Farms | 30 GB |
|
|
| Prentke Romich Company | 250 GB |
|
|
| S. Walter Packaging |
|
||
| Clatronic International GmbH | 469 GB |
|
|
| Seaway Manufacturing Corp. |
|
||
| Ziba Design | 22 GB |
|
|
| IOI Corporation Berhad | 20 GB |
|
|
| Hi-P International | 22 GB |
|
|
| unknown | 0 | ||
| BASF | Nunhems | 30 GB |
|
|
| City of Cold Lake | 10 GB |
|
|
| Odessa College | 18 GB |
|
|
| 00 | 0 |
|
|
| Wichita State University Campus of Applied Sciences and Technology | 10 GB |
|
|
| Geelong Lutheran College | 4GB |
|
|
| Asbury Theological Seminary | 10 GB |
|
|
| Djg Projects | 19.4GB |
|
|
| Verweij Elektrotechniek | 95GB |
|
|
| Alvin Independent School District | 60GB |
|
|
| West Allis-West Milwaukee School District | 9,5 GB |
|
|
| German University of Technology in Oman | 10 GB |
|