Lost in the Fog: A New Ransomware Threat

Arctic Wolf Labs analyzed a newly observed ransomware variant dubbed 'Fog' active in May 2024 against U.S. education and recreation sector victims, noting initial access via compromised VPN credentials, rapid VM-focused encryption, deletion of volume shadow copies, and the use of tools like PsExec, SharpShares, and Veeam-Get-Creds.ps1; the report includes technical analysis, IoCs (hashes, hostnames, IPs, filenames, extensions), TTP mapping to MITRE ATT&CK, and detection recommendations.