Lost in the Fog: A New Ransomware Threat

### Executive Summary Arctic Wolf Labs observed a new ransomware variant named "Fog" active in May 2024 against US organizations (predominantly education), where threat actors used compromised VPN credentials, credential stuffing, and pass-the-hash to gain access, moved laterally with PsExec and RDP/SMB, disabled Windows Defender, encrypted VM storage (appending .fog/.flocked), deleted Veeam backups and volume shadow copies, and left ransom notes; the report includes technical analysis, TTP mappings, IoCs (hashes, IPs, filenames), and detection guidance.