Lost in the Fog: A New Ransomware Threat

Arctic Wolf Labs observed an emerging ransomware variant dubbed “Fog” deployed against US organizations—predominantly in the education sector—using compromised VPN credentials, credential stuffing and pass-the-hash to gain access, then leveraging PsExec, RDP/SMB to move laterally; the actors encrypted VM storage (appending .fog/.flocked), deleted Veeam/volume shadow backups, disabled Windows Defender, left uniform ransom notes, and the report contains technical analysis, TTP mappings, IoCs (hashes, filenames, IPs, hostnames) and detection opportunities.