Fog is a ransomware operation first identified by Arctic Wolf in May 2024 that initially targeted US education and recreation organisations, usually entering through compromised VPN credentials and moving quickly to encrypt virtualized infrastructure. Early intrusions emphasised rapid encryption of VM storage and backup destruction over data theft; later 2024 and 2025 reporting shows the operation broadening its sectors, correlating heavily with compromised SonicWall SSL-VPN access, and adopting unusual tooling and troll-style ransom notes. Sources differ on whether Fog is best described as a distinct group, a variant, or a maturing ransomware-as-a-service ecosystem — an ambiguity worth keeping in view.
Overview & Timeline
- 2 May 2024. Arctic Wolf first observed the activity it named Fog.
- June 2024. Public reporting on US education and recreation targeting via VPN.
- Aug–Nov 2024. High correlation reported between Fog intrusions and SonicWall SSL-VPN access; CVE-2024-40766, a SonicWall SSL-VPN access-control flaw, is cited among entry vectors.
- Jan–Mar 2025. Fog-associated actors reported targeting GitLab environments and stealing source code.
- Spring 2025. Trend Micro documented a phishing campaign dropping Fog with DOGE-themed ransom notes via a ZIP named “Pay Adjustment.zip.”
- May 2025. Symantec reported a Fog attack on an Asian financial-sector firm using an unusual toolset.
Early Arctic Wolf cases showed no data exfiltration and no leak site; later reporting indicates double extortion and a leak site at times. Fog’s exfiltration behaviour appears to have varied by intrusion and period — treat it as a range, not a single mode.
Initial Access & Movement
- Initial access predominantly via compromised or stolen VPN credentials, with many later intrusions tied to SonicWall SSL-VPN; the DOGE campaign used phishing instead. T1133 T1078
- Credential access and movement via pass-the-hash against administrator accounts, credential stuffing, and RDP and SMB to reach targets, with PsExec used to distribute the ransomware. T1550.002 T1021.001 T1569.002
- A PowerShell script,
Veeam-Get-Creds.ps1, was used to pull credentials from Veeam Backup & Replication. T1003 - Discovery with SoftPerfect Network Scanner, Advanced Port Scanner and SharpShares. T1046 T1135
Encryption & Impact
- Defense evasion by disabling Windows Defender to suppress victim alerts. T1562.001
- Targets virtualized infrastructure — encrypting and tampering with VMDK files in VM storage. T1485
- Inhibits recovery by deleting Veeam backups and Windows volume shadow copies. T1490
- Encryption renames files with
.fogor.flockedextensions and drops a ransom note (reported asreadme.txt, andreadme.htmlin some cases) pointing to a Tor negotiation portal. T1486
In the May 2025 financial-sector case, Symantec reported Fog using Syteca (formerly Ekran) legitimate employee-monitoring software — reportedly a first in a ransomware chain — alongside the open-source tools GC2, Adaptix and Stowaway, with a roughly two-week dwell time and a service created after encryption for persistence. This was one targeted incident, distinct from the DOGE phishing campaign.
MITRE ATT&CK Mapping
| Tactic | Technique | Usage |
|---|---|---|
| Initial Access | T1133 External Remote Services | VPN access |
| Initial Access | T1078 Valid Accounts | Compromised VPN and admin credentials |
| Lateral Movement | T1550.002 Pass the Hash | Admin account reuse |
| Execution | T1569.002 Service Execution | PsExec distribution |
| Credential Access | T1003 OS Credential Dumping | Veeam credential extraction |
| Defense Evasion | T1562.001 Impair Defenses | Disable Windows Defender |
| Impact | T1490 Inhibit System Recovery | Delete Veeam backups and shadow copies |
| Impact | T1486 Data Encrypted for Impact | Encryption of VM storage and files |
Detection Signals
Take file hashes from the vendor primary reports (Arctic Wolf, Symantec) rather than secondary aggregators. The behavioural and filename signals below are the durable ones.
- Encrypted-file extensions
.fogand.flocked, and ransom notes namedreadme.txtorreadme.htmlpointing to a Tor portal. - Presence of
PSEXESVC.exe, network scanners (SoftPerfect / Advanced Port Scanner), SharpShares, and theVeeam-Get-Creds.ps1script in PowerShell script-block logs. - Mass deletion of Veeam backups and volume shadow copies; bulk access or modification of VMDK files.
- In targeted 2025 cases: unexpected Syteca / Ekran agent presence, GC2, Adaptix or Stowaway binaries, and a service created after encryption.
Detection & Mitigation
- Harden remote access. Require MFA on all VPN access, patch SonicWall SSL-VPN appliances (CVE-2024-40766), rotate compromised credentials, and monitor VPN logins for anomalous geolocation and reuse.
- Protect backups. Keep immutable or offline Veeam backups, restrict Credential Manager access, and alert on backup and shadow-copy deletion. Enable PowerShell script-block logging and AMSI to catch credential-theft scripts.
- Enable tamper protection and prevent Defender or EDR from being disabled.
- Constrain lateral movement. Restrict PsExec and SMB admin shares, monitor for pass-the-hash and credential stuffing, and enforce least privilege on admin accounts.
- Protect virtualization. Segment virtualization hosts and VM storage, and detect bulk VMDK access. Treat unauthorised employee-monitoring software as a possible ransomware precursor.
Build Ransomware Resilience
Mjolnir Security helps organisations harden remote access and backups against operations like Fog, and responds when encryption starts.
- Ransomware Readiness Assessment Review of VPN, backup and virtualization controls against the access-to-encryption path Fog uses.
- Managed Detection and Response Monitoring for VPN credential abuse, backup deletion and bulk VM encryption before impact spreads.
- 24/7 Incident Response Containment, eradication and recovery when ransomware is detected. Call +1 833 403 5875.
Stay ahead of emerging threats. Get notified when we publish new intelligence reports and advisories.
Subscribe to Alerts