Credential Theft
- DonPAPI
- Veeam-Get-Creds
Fog
Fog is a ransomware family first observed in 2024 and associated with rapid, opportunistic intrusions that have notably affected organizations in the United States, especially education and recreation, while also appearing in broader enterprise ransomware activity.
Profile source: Mallory opens in a new tabFog
Family profile
Fog is a ransomware family first observed in 2024 and associated with rapid, opportunistic intrusions that have notably affected organizations in the United States, especially education and recreation, while also appearing in broader enterprise ransomware activity. It has been linked to attacks against Windows environments and has also been reported in operations affecting virtualized infrastructure such as VMware and ESXi-adjacent backup environments. Fog has been deployed in incidents involving compromised VPN access, including SonicWall SSL VPN accounts, and in some cases exploitation of Veeam Backup & Replication vulnerabilities such as CVE-2024-40711. Reporting also links Fog activity to operators tracked in overlapping clusters and to distribution by Storm-0844, with some tradecraft overlap noted with Akira-related operations.
Capabilities
- Brute Force
- Defense Evasion
- Exfiltration
- Extortion
- Initial Access
- Lateral Movement
- Persistence
- Post Exploitation
- Privilege Escalation
- Reconnaissance
- Scanning
Operational record
54
Indicators
1
YARA rules
2
Ransom notes
6
Negotiations
2
Leak sites
0 available
Discovery Enum
- Advanced Port Scanner
- SharpShares
- SoftPerfect NetScan
LOLBAS
- PsExec
Networking
- Powercat
- Proxychains
Offsec
- Certipy
- Impacket
- Metasploit
- NetExec
- Orpheus
- Sliver
- Zer0dump
RMM Tools
- AnyDesk
Published indicators
Md5
53 totalda15ca8a6a316ee543ecc0cf4799700ecff6c948bfede2c14590bd5daacd96efd16ec8c2dc42401f3acea469c128d98121c244771422cf24ef49cdaf2b437c12f6359f375ae370e15bfef366f238ee15a8c09a3ad7a8faab7be4d46bbec4e01a8b157ad42fa665d263904052f56a009b470a328ad3705d0c6866a48912a3f718bcd51ee1df396f07af0b0a345a6dbaf4935d7db2557d62a55a23b6020d42351c
Exploited software
Vulnerabilities linked to Fog
10 CVEs CVE-2024-40766 Improper Access Control in SonicWall SonicOS Management and SSLVPN CVE-2024-40711 Unauthenticated RCE in Veeam Backup & Replication CVE-2023-48365 DoubleQlik / HTTP Tunneling RCE in Qlik Sense Enterprise for Windows CVE-2024-21762 Fortinet FortiOS/FortiProxy SSL-VPN Out-of-Bounds Write RCE CVE-2023-27997 XORtigate: Heap-Based Buffer Overflow in Fortinet FortiOS/FortiProxy SSL-VPN CVE-2025-23006 SonicWall SMA1000 AMC/CMC Pre-Authentication Deserialization RCE CVE-2025-23120 Remote Code Execution in Veeam Backup & Replication CVE-2024-53704 SonicWall SonicOS SSLVPN Authentication Bypass CVE-2019-7481 SQL Injection in SonicWall SMA100 CVE-2021-20028 SQL Injection in SonicWall Secure Remote Access (SRA) Appliances
MITRE ATT&CK
