Fog

public reporting will tie initial access in a consequential incident or bounded campaign to artifacts obtained through a separate, earlier edge-appliance exposure

Attacks leveraged compromised VPN appliances for access... Similar to the previous events, the threat actor used a compromised VPN appliance for access...

The vulnerability, CVE-2024-40711, was used as part of a threat activity cluster we named STAC 5881.

atexec, Remote scheduled task, Scheduled Task events (4698)... In one engagement, attackers leveraged Active Directory Group Policy to distribute the ransomware payload as a scheduled task across domain-joined systems, ensuring simultaneous execution at scale.

atexec, Remote scheduled task, Scheduled Task events (4698)... In one engagement, attackers leveraged Active Directory Group Policy to distribute the ransomware payload as a scheduled task across domain-joined systems, ensuring simultaneous execution at scale.

public reporting will tie initial access in a consequential incident or bounded campaign to artifacts obtained through a separate, earlier edge-appliance exposure

Attacks leveraged compromised VPN appliances for access... Similar to the previous events, the threat actor used a compromised VPN appliance for access...

...used the VEEAM vulnerability to create a new local administrator account named “point”. Similar to the previous events... created a new account named ‘point’. However in this incident a ‘point2’ account was also created.

atexec, Remote scheduled task, Scheduled Task events (4698)... In one engagement, attackers leveraged Active Directory Group Policy to distribute the ransomware payload as a scheduled task across domain-joined systems, ensuring simultaneous execution at scale.

public reporting will tie initial access in a consequential incident or bounded campaign to artifacts obtained through a separate, earlier edge-appliance exposure

public reporting will tie initial access in a consequential incident or bounded campaign to artifacts obtained through a separate, earlier edge-appliance exposure

A qualifying case must clear four gates: Previously exposed artifacts are successfully reused. The reuse enables initial access in a consequential incident or bounded campaign.

PsExec and direct access to administrative shares (ADMIN$, C$, etc.) remained present in some engagements... The most common approach involved executing the ransomware binary from a single compromised system — typically a domain controller or infrastructure server — and encrypting data on remote systems through administrative shares (ADMIN$, C$).

Some cases in this cluster led to the deployment of Akira or Fog ransomware... observed the deployment of a previously-undocumented ransomware called “Frag”. When encrypted, files are given a .frag extension.

Prior to encryption, attackers systematically targeted backup infrastructure and virtualization platforms to maximize impact and eliminate recovery options: Hypervisors (VMware ESXi, Hyper-V) – Destruction or encryption of virtual machines at the hypervisor level; Backup infrastructure (Veeam) – Access via compromised privileged accounts or exploitation of known Veeam vulnerabilities to delete or encrypt backup repositories.