Ransomware Group
Fog
Fog, which uses the .flocked extension for encrypted files, was first observed in May in campaigns by Storm-0844, a threat actor known for distributing Akira. By June, Storm-0844 was deploying Fog more than Akira.
Known victims189
Threat level
HIGH
Get an alert if one of your domains is named on a ransomware leak site.
Monitor your domainsFree account · up to 5 monitored targets
Tactics, Techniques & Procedures (TTPs)
CredentialTheft
- DonPAPI
- Veeam-Get-Creds
DiscoveryEnum
- Advanced Port Scanner
- SharpShares
- SoftPerfect NetScan
LOLBAS
- PsExec
Networking
- Powercat
- Proxychains
Offsec
- Certipy
- Impacket
- Metasploit
- NetExec
- Orpheus
- +2 more
RMM-Tools
- AnyDesk
Known infrastructure
The following Tor hidden services have been associated with this group:
Blog500 Internal Server Error
These sites are malicious. Open them only from an isolated environment.
Check if you’re affected
Look up your domain to see whether it appears on Fog’s victim list.
Try it nowFree⌘K
Try
risk score · threat categories · sources · age · confidence — in one request