'Fog' Hackers Troll Victims With DOGE Ransom Notes

Trend Micro analyzed active Fog ransomware campaigns that begin with phishing ZIPs containing malicious LNK files which execute PowerShell to download a ransomware downloader, system-harvesting scripts, lateral-movement tools, and display DOGE-themed ransom notes; operators have shifted toward double-extortion with data theft and a leak site. Researchers and other vendors report around 100 victims since January and 173 detections since June 2024 across technology, manufacturing, education, and transportation sectors, and have published IoCs and standard mitigation guidance.