'Fog' Ransomware Rolls in to Target Education, Recreation Sectors

Arctic Wolf researchers identified a new ransomware group called “Fog” conducting short, quick-pay ransomware attacks (May 2–23) that target virtualized environments by using stolen VPN credentials and administrator account compromises to access Hyper‑V and Veeam-protected Windows servers; the group encrypts data without exfiltration or leak-site/double-extortion behavior and has predominantly hit U.S. education organizations.