Ransomware.live fog

Fog

Fog, which uses the .flocked extension for encrypted files, was first observed in May in campaigns by Storm-0844, a threat actor known for distributing Akira. By June, Storm-0844 was deploying Fog more than Akira.

External information

https://arcticwolf.com/resources/blog/lost-in-the-fog-a-new-ransomware-threat/

Victims

189

First Discovered

victim

2024-07-16

Last Discovered

victim

2025-03-20

Avg Delay

between attack and claim

57.4 days

Infostealer

for victim with domain

29.1%

View Victims on World Map

View group statistics

Known Locations (4)

Title	Available	Last Visit	FQDN
500 Internal Server Error	No	2025-07-05 15:30:10	`xql562evsy7njcsngacphc2erzjfecwotdkobn3m4uxu2gtqh26newid.onion`
Blog	No	2025-06-01 21:19:31	`xbkv2qey6u3gd3qxcojynrt4h5sgrhkar6whuo74wo63hijnn677jnyd.onion`
Blog	No	2025-06-01 21:19:38	`xbkv2qey6u3gd3qxcojynrt4h5sgrhkar6whuo74wo63hijnn677jnyd.onion`
500 Internal Server Error	No	2025-07-05 15:30:26	`xql562evsy7njcsngacphc2erzjfecwotdkobn3m4uxu2gtqh26newid.onion`

Target (Available)

Heatmap (Available)

Ransom Notes (2)

Tools Used (Available)

This information is provided by Ransomware-Tool-Matrix
Discovery	RMM Tools	Defense Evasion	Credential Theft	OffSec	Networking	LOLBAS	Exfiltration
Advanced Port Scanner SharpShares SoftPerfect NetScan placeholder placeholder placeholder placeholder	AnyDesk placeholder placeholder placeholder placeholder placeholder placeholder	placeholder placeholder placeholder placeholder placeholder placeholder placeholder	DonPAPI Veeam-Get-Creds placeholder placeholder placeholder placeholder placeholder	Certipy Impacket Metasploit NetExec Orpheus Sliver Zer0dump	Powercat Proxychains placeholder placeholder placeholder placeholder placeholder	PsExec placeholder placeholder placeholder placeholder placeholder placeholder	placeholder placeholder placeholder placeholder placeholder placeholder placeholder

Vulnerabilities Exploited (0)

TTPs Matrix (0)

Negotiation Chats (6)

YARA Rules (0)

Indicators of Compromise (IoCs) (54)

MD5 54

Type	IOC
`md5`	`da15ca8a6a316ee543ecc0cf4799700e`
`md5`	`cff6c948bfede2c14590bd5daacd96ef`
`md5`	`d16ec8c2dc42401f3acea469c128d981`
`md5`	`21c244771422cf24ef49cdaf2b437c12`
`md5`	`f6359f375ae370e15bfef366f238ee15`
`md5`	`a8c09a3ad7a8faab7be4d46bbec4e01a`
`md5`	`8b157ad42fa665d263904052f56a009b`
`md5`	`470a328ad3705d0c6866a48912a3f718`
`md5`	`bcd51ee1df396f07af0b0a345a6dbaf4`
`md5`	`935d7db2557d62a55a23b6020d42351c`
`md5`	`b5e1521ea5ffa2d5ec13cef61ffe363d`
`md5`	`890fef6aa06bce73db52ee3087fa2a0e`
`md5`	`dee2ecb51fbfa2f1de9dbe9a7524da12`
`md5`	`18f9eebf70db818c0f2a3c865f7132ee`
`md5`	`7d5b84b38766dacb04066d56908097b9`
`md5`	`5e1eec7d018f2dbd1280cd0c238e830d`
`md5`	`09127f6b39c0c6aab163f010b7086acc`
`md5`	`517ac3f7fc52792734b9a00a57cc5ae4`
`md5`	`470a328ad3705d0c6866a48912a3f718`
`md5`	`fd471239a6c4314c4f5f2ea7cc8e5cd5`
`md5`	`be5af780a67635d1eae32bc959450aff`
`md5`	`f162816f1d7b0006cfa0bfaf95c492c4`
`md5`	`4d5bec4d9d32e00c7d0b9d89e3948c8f`
`md5`	`6195c398e48d65c5e33278a01089a45b`
`md5`	`cfabf91cef8cb93ca8f2da8492015e25`
`md5`	`a4e7b94c88a041d5e9983a704053f01c`
`md5`	`7b795e5db82f25b8261d70048b2c3940`
`md5`	`e1edeaf3a358e7c356592cf2fea83ecd`
`md5`	`83c419015c4d8df7cb1a208546ddb6f6`
`md5`	`4215b5ce20e033aeed7c56ae2e0eec60`
`md5`	`ef031581f138375a47a683253fea8768`
`md5`	`4e9c72ca533aff19b5beaa0dd0df9276`
`md5`	`d14ec0d9f4c265174c54d0f949e006ea`
`md5`	`dfb38db3eeee3287524d4d3aacae8c45`
`md5`	`bef7a4725f55879af412d32f0b3b06bb`
`md5`	`64433a8a138c62661da2ccf552483c33`
`md5`	`7cc06e17a31673726f8fb94789252a93`
`md5`	`8f052170eb9c8cda872d07888753c5e7`
`md5`	`240eb6d3415de2284e03ba8a586ed724`
`md5`	`868d8f2e942dd73b8ba9022fe7676032`
`md5`	`6e48a67e0005cd6299d585314830af69`
`md5`	`c18dd6b7d1acf12d39ebb017a21a4a3e`
`md5`	`3226adfad6c5d31065347fbd2bda10e2`
`md5`	`1a0a919dff09f63366f27f5e4c865d75`
`md5`	`9bfa6efef31916adcb6d447b48434be5`
`md5`	`b1094be42cf05bdd38951c8bf5c83cfd`
`md5`	`f63c17d6753abb95d876f5c02dc57ad5`
`md5`	`25a14b8104eb50d56c46df79b0df37bf`
`md5`	`617d79c02ebac68b613d5b7cdbf001fd`
`md5`	`07c6b4756715d73304ec0ebc951dddad`
`md5`	`ba4039b27f64a90d1038905f8b8804d0`
`md5`	`0a6dd4eee2a0629d1da62f248a17ec80`
`md5`	`d72c3508cbb968c478e0bd91e0f11424`
`md5`	`bfc3dfd07dcf918bb87126fac4c62e7c`