Fog Ransomware — Ransomware Profile
Fog ransomware emerged mid-2024 targeting education, financial services, and recreation. Uses VPN compromise with LNK-based droppers deploying PowerShell scripts. Targets Windows and Linux. Named by Halcyon as top emerging group for 2025.Also tracked as
Fog
Tools & malware
- Fog Encryptor Ransomware
- FreeFileSync Exfiltration
- MegaSync Exfiltration
Recent claimed victims
- Newtown Friends School (newtownfriends.org) 2025-03-20
- RAE (Real Academia Española) (rae.es) 2025-03-17
- El Camino Real Academy (elcaminorealacademy) 2025-03-13
- University Diagnostic Medical Imaging, PC (udmi.net) 2025-03-13
- Wilkinson Rogers (wilkinsonrogers.com) 2025-03-11
- Magnolia Manor (magnoliamanor.com) 2025-03-10
- Euranova 2025-03-06
- Inelmatic 2025-03-06
- CIE 2025-03-06
- Bizcode 2025-03-06
- FHNW 2025-03-06
- Melexis 2025-03-06
- Eumetsat 2025-03-06
- WJCC Public Schools (wjccschools.org) 2025-03-06
- Blue Planet 2025-03-06
- Kr3m 2025-03-06
- 1X Internet 2025-03-06
- Aeonsparx 2025-03-06
- Kotliva 2025-03-06
- USGS 2025-03-06
- Oberlin Cable Co-op (oberlin.net) 2025-03-06
- Engikam 2025-03-06
- Flightsim studio 2025-03-06
- Inet 2025-03-06
- InfoReach 2025-03-06
Vendor research
- New Ransomware Fog Spread via Compromised VPNs Trend Micro
- Fog Ransomware: An Emerging Threat Arctic Wolf
- Fog Ransomware: A New Threat Targeting Education and Recreation SentinelOne