Fog Ransomware Attacking US Organizations Leveraging Compromised VPN Credentials

A new Fog ransomware variant has been observed since early May 2024 targeting U.S. education and recreation organizations; attackers gain initial access using compromised VPN credentials, perform pass-the-hash and credential-stuffing driven lateral movement (PsExec, RDP, SMB), disable Windows Defender, target Hyper-V and Veeam backup systems, encrypt files (extensions .FOG/.FLOCKED) after importing an RSA key, and remove volume shadow copies to thwart recovery.