Loading story…
Researchers reported that Fog ransomware is being deployed through a heavily obfuscated, multi-stage loader designed to frustrate analysis and bypass defenses. The initial loader uses large amounts of junk code, anti-sandbox and anti-debugging checks, and DLL unhooking before decrypting a second-stage shellcode that resolves APIs through hashing, reflectively loads an embedded DLL, and triggers its DLLRegisterServer export to launch the ransomware payload. Trend Micro also linked Fog activity to criminals claiming ties to DOGE, indicating an effort to brand or disguise the operation while expanding distribution.
The final Fog payload decrypts an internal JSON configuration and ransom note, creates a mutex, performs host reconnaissance, and attempts to stop selected processes and services before deleting shadow copies and encrypting files with a multithreaded routine. The ransom note says victims' data was both encrypted and exfiltrated, and it directs targets to Tor-based contact infrastructure, underscoring Fog's use of double-extortion tactics alongside layered evasion and execution techniques.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
A public malware analysis documented a Fog ransomware sample delivered through a loader that used anti-sandboxing, anti-debugging, DLL unhooking, second-stage shellcode, and a final DLL that encrypted files and claimed data exfiltration. The analysis also published hashes, mutex, configuration details, ransom-note contents, and reconnaissance behavior.
Trend Micro published research describing Fog ransomware being concealed within binary loaders and spread by cybercriminals claiming ties to DOGE. The report documents the malware’s loader-based delivery and broader campaign characteristics.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers identified **FuxSocy Encryptor** as a ransomware family that closely imitates the defunct **Cerber** strain in both presentation and parts of its internal logic. The malware encrypts victim files with **AES**, scrambles or renames filenames in Cerber-like patterns, drops ransom notes such as `***__READ___THIS__***.txt`, and can change the desktop wallpaper after locking data. Analysis found it skips or prioritizes certain folders, includes anti-virtual-machine checks, and in some variants partially encrypts files beginning at offset `0x708`, a technique that still leaves many documents unusable. The operators initially directed victims to make contact through **qTox/ToxChat** rather than a Tor payment portal, later shifting some variants to email addresses including `king-size_banana@thesecure.biz` and `fuxsocy@cockl.li`. Reporting on later samples shows the family remained active in subsequent years with variants using extensions such as `.b58d`, while likely relying on common intrusion routes including exposed **RDP**, phishing emails, malicious attachments, fake downloads, exploits, malvertising, and trojanized installers. No free decryptor was available in the early reporting, and victims were advised to recover from backups instead of paying the ransom.
Aug 15, 2026
FortiGuard Labs said the **DeathRansom** ransomware campaign is strongly tied to **Vidar** stealer activity and several other malware operations through shared infrastructure, naming conventions, and recurring attribution artifacts. Researchers found Vidar samples attempting to access Bitbucket paths under the profile name **`scat01`** and likely retrieving DeathRansom variants named in the **`Wacatac_YYYY-MM-DD_HH-MM.exe`** format. The same cluster was also linked to **Azorult**, **Evrial stealer**, **1ms0rryStealer**, and **Supreme miner**, with repeated use of identifiers including the nickname **`scat01`**, the email **`vitasa01@yandex.ru`**, and the domain **`gameshack[.]ru`**. FortiGuard assessed that false Slovak and Nepali language artifacts were likely planted to mislead investigators, while other evidence pointed to a Russian-speaking operator associated with the online persona **SoftEgorka** and likely connected to **Egor Nedugov** from the Rostov-on-Don/Aksay area. Separate technical profiling described DeathRansom, also detected in some cases as **Wacatac**, as a ransomware family that evolved from early variants that sometimes only mimicked encryption into later builds that performed real file encryption. The malware primarily targeted English-speaking users, dropped a **`read_me.txt`** ransom note, demanded Bitcoin payment through attacker-controlled email addresses, and checked systems against a whitelist of CIS-region languages before running. Analysts documented multiple delivery paths, including **RDP compromise**, spam, malicious downloads, botnets, exploits, malvertising, fake updates, and trojanized installers, and noted changing cryptographic implementations involving **Curve25519/ECDH**, **Salsa20**, **RSA-2048**, **AES**, and **SHA-256**. The reporting also noted code or family relationships with **EZDZ-Locker**, **TechandStrat**, **HelloKitty**, **FiveHands**, **DCRTR**, and **STOP** ransomware.
Aug 15, 2026
Researchers reported that **Payload** is a newly observed ransomware strain targeting Windows environments and rapidly expanding its operations, with about 50 victims listed on its leak site by late March. The malware appends the `.payload` extension to encrypted files and drops a ransom note named `RECOVER_payload.txt`, while focusing on sectors where downtime can quickly drive extortion pressure, including logistics, transportation, construction, real estate, manufacturing, and technology. Technical analysis indicates Payload uses a mature cryptographic design built on per-file **Curve25519 ECDH** key exchange and **ChaCha20** encryption, making recovery without the operators’ private key effectively infeasible. The ransomware also uses aggressive anti-forensics and disruption tactics before encryption, including deleting shadow copies, clearing Windows Event Logs, patching ETW-related functions in `ntdll`, terminating processes, and stopping backup and database services. Separate reporting on **Vect** highlighted a contrasting trend in the ransomware ecosystem: although Vect marketed enterprise-focused cross-platform ransomware for Windows, Linux, and ESXi, researchers found a critical cryptographic flaw that irreversibly destroys files larger than 128 KB, effectively turning many attacks into data wiping events even if victims pay. Together, the findings show a split between technically competent operators such as Payload and poorly engineered ransomware like Vect that can still cause severe business disruption.
Jun 29, 2026