Dark Web Profile: Fog Ransomware

Fog Ransomware (observed Apr–May 2024) is a double-extortion ransomware variant targeting primarily U.S. organizations—notably education, business services, and technology firms—across Windows and Linux endpoints; actors exfiltrate data (using tools like rclone), encrypt files (appending .fog/.Fog/.FLOCKED), and publish stolen data on a TOR-based leak site, with attacks leveraging phishing, RDP/exploitation, credential dumping (Mimikatz), Cobalt Strike, and lateral movement; the report includes MITRE TTP mappings, a victim breakdown (~118 victims with 60 in the U.S.), recommended mitigations (MFA, EDR, segmentation, backups), and defensive services.