Fog
Fog ransomware is a ransomware family first observed in May 2024 and active through at least 2025. Reporting consistently describes it as a new ransomware strain, with some sources characterizing it as a variant of STOP/DJVU. It has been associated with double extortion in multiple reports, though early Arctic Wolf cases in May 2024 noted no observed data exfiltration. Fog has been linked operationally with Akira in several investigations, including shared tradecraft, overlapping infrastructure, and common exploitation of edge and backup technologies; one report also states Fog was distributed by Storm-0844, which has also propagated Akira.
Observed targeting includes U.S. education and recreation organizations, with Arctic Wolf reporting early May 2024 cases concentrated in those sectors, and Kroll reporting heavy targeting of higher education in the United States. Other reporting places Fog in broader opportunistic intrusions across multiple industries, including a financial institution in Asia where attackers deployed Fog alongside AdaptixC2. CERT Intrinsec also observed Fog among ransomware families affecting French organizations in 2025.
Initial access has repeatedly involved compromised or stolen VPN credentials and SSL VPN access. Multiple reports tie Fog intrusions to SonicWall SSL VPN accounts, with Arctic Wolf observing at least 30 Akira/Fog intrusions from early August through mid-October 2024 where SonicWall SSL VPN was early in the kill chain. Fog has also been linked to exploitation or abuse of SonicWall SonicOS CVE-2024-40766, including credential harvesting from SonicWall SSL VPN firewalls. Additional reporting links Fog attacks to exploitation of Veeam Backup & Replication servers via CVE-2024-40711, including Sophos tracking of cluster STAC 5881, where compromised VPN appliances were used for access and the Veeam flaw was used to create a local administrator account named "point" before deployment of Fog or Akira. Separate reporting states Akira and Fog used the Veeam flaw starting in October 2024.
Post-compromise behavior described across the sources includes pass-the-hash, brute forcing or credential stuffing of additional accounts, extraction of credentials from browsers and NTDS.dit, use of RDP for persistence, creation of new accounts, and use of tools such as PsExec, Metasploit, SoftPerfect Network Scanner, Advanced Port Scanner, SharpShares, Rclone, WinSCP, FileZilla, reverse SSH shells, and Veeam-Get-Creds.ps1. In some incidents, attackers disabled Windows Defender, deleted firewall logs, and used vssadmin.exe to delete shadow copies. Fog operators were reported to focus on virtual machine infrastructure and backups, including Hyper-V, VMware ESXi, and Veeam systems.
The ransomware itself has been described as encrypting a broad range of files, including VMDKs, deleting Veeam backups and Windows Volume Shadow Copies, appending .FOG or .FLOCKED extensions, and dropping a ransom note typically named "readme.txt" with a Tor-based negotiation site and chat interface. Arctic Wolf additionally reported a JSON configuration controlling encryption behavior, ransom note names, service shutdowns, and configured extensions. One report noted the payload creates DbgLog.sys in %AppData% and references NTDLL.DLL and NtQuerySystemInformation. Command-line options observed include NOMUTEX, TARGET, and CONSOLE. Encryption was described as using symmetric encryption with the symmetric key protected by asymmetric encryption.
Operationally, Fog has been characterized as fast-moving. Arctic Wolf reported encryption sometimes began within 1.5 to 2 hours of initial SSL VPN access, and other reporting states some Fog intrusions achieved full network encryption in under four hours. Known indicators and artifacts directly mentioned in the content include the local administrator account name "point" created in some Veeam-related intrusions, file extensions .FOG and .FLOCKED, ransom note name "readme.txt," creation of DbgLog.sys in %AppData%, and use of SonicWall log event IDs 238, 1080, and 1079 in observed SSL VPN intrusions.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
10 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The vulnerability, CVE-2024-40711, was used as part of a threat activity cluster we named STAC 5881. Attacks leveraged compromised VPN appliances for access and used the VEEAM vulnerability to create a new local administrator account named “point”. Some cases in this cluster led to the deployment of Akira or Fog ransomware. | Some cases in this cluster led to the deployment of Akira or Fog ransomware. Fog emerged earlier this year, first seen in May.
CVE-2023-48365: Qlik Sense Enterprise HTTP Tunneling RCE (CVSS 9.9)
CVE-2024-21762: Fortinet FortiOS SSL VPN Out-of-Bounds Write RCE (CVSS 9.8)
CVE-2023-27997: Fortinet FortiOS SSL VPN Heap Buffer Overflow RCE - XORtigate (CVSS 9.8)
CVE-2025-23006: SonicWall SMA 1000 Pre-Auth Deserialization RCE (CVSS 9.8)
CVE-2024-40766: SonicWall SonicOS Improper Access Control (CVSS 9.8)
Referenced via: https://labs.watchtowr.com/by-executive-order-we-are-banning-blacklists-domain-level-rce-in-veeam-backup-replication-cve-2025-23120/ and multiple linked articles about Veeam RCE flaws.
Defenders should act now — ... patch CVE-2024-53704 (CVSS 9.8, CISA KEV) ... Exploitation Assessment ... CVE-2024-53704 ... Campaign Sessions 5 ... Confirm your SonicOS firmware is patched against CVE-2024-53704 (versions at or below 7.1.1-7058, 7.1.2-7019, or 8.0.0-8035 are vulnerable).
Fog ransomware accounts for another significant share, with some documented intrusions achieving full network encryption in under four hours.
Fog ransomware accounts for another significant share, with some documented intrusions achieving full network encryption in under four hours.
Techniques & procedures
8 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
3 techniques
Initial Access
Both groups have primarily focused on exploiting VPN vulnerabilities, which allows them to gain unauthorized access to networks and consequently deploy their ransomware.
Execution
1 technique
Execution
Persistence
4 techniques
Persistence
atexec, Remote scheduled task, Scheduled Task events (4698)... In one engagement, attackers leveraged Active Directory Group Policy to distribute the ransomware payload as a scheduled task across domain-joined systems, ensuring simultaneous execution at scale.
Both groups have primarily focused on exploiting VPN vulnerabilities, which allows them to gain unauthorized access to networks and consequently deploy their ransomware.
Privilege Escalation
2 techniques
Privilege Escalation
Stealth
1 technique
Stealth
Lateral Movement
1 technique
Lateral Movement
PsExec and direct access to administrative shares (ADMIN$, C$, etc.) remained present in some engagements... The most common approach involved executing the ransomware binary from a single compromised system — typically a domain controller or infrastructure server — and encrypting data on remote systems through administrative shares (ADMIN$, C$).
Impact
2 techniques
Impact
Some cases in this cluster led to the deployment of Akira or Fog ransomware... observed the deployment of a previously-undocumented ransomware called “Frag”. When encrypted, files are given a .frag extension.
Prior to encryption, attackers systematically targeted backup infrastructure and virtualization platforms to maximize impact and eliminate recovery options: Hypervisors (VMware ESXi, Hyper-V) – Destruction or encryption of virtual machines at the hypervisor level; Backup infrastructure (Veeam) – Access via compromised privileged accounts or exploitation of known Veeam vulnerabilities to delete or encrypt backup repositories.
Recent activity
32 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware mentioned as leveraging a Veeam Backup & Replication (VBR) RCE vulnerability in attacks starting in October 2024.
Ransomware reported in intrusions leveraging SonicWall VPN access, with rapid progression to full network encryption in some cases.
Ransomware family observed in double-extortion incidents where data exfiltration preceded encryption.
Fog is a ransomware variant that targets organizations in the education and recreation sectors in the United States. It is deployed via compromised VPN credentials, uses common penetration testing and lateral movement tools, and encrypts files with .FOG or .FLOCKED extensions. It disables Windows Defender, deletes shadow copies, and leaves ransom notes, but there is no evidence of data exfiltration.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.