New research uncovers newly identified ransomware strain named Fog

Recent research has uncovered the emergence of a new type of ransomware known as Fog. The study, carried out by Arctic Wolf Labs, identified multiple instances of Fog ransomware and found consistent characteristics across them. The primary targets of Fog’s ransomware attacks were mainly in the United States, with 80% focusing on the education sector and 20% on the recreation industry.

The study categorizes Fog as a ransomware variant rather than a ransomware group to distinguish between groups that create the encryptor software and those that execute the attacks. The organizational structure of the group or groups responsible for deploying Fog ransomware remains unknown at this time. The researchers suggest that as more information about Fog becomes available, additional insights may be incorporated into the study.

As per the research findings, threat actors in the analyzed cases gained entry to target environments by exploiting compromised VPN credentials. Two different VPN gateway vendors were utilized for remote access. The most recent documented activity linked to Fog ransomware was recorded on May 23, 2024.