Executive Summary

Since April 2024, Arete’s Incident Response (IR) team has responded to multiple engagements attributed to the Fog ransomware group. Engagements attributed to this group have been trending up since mid-June and through July 2024, accounting for nearly 20% of Arete’s ransomware and extortion engagements in July. The Fog ransomware group is especially noteworthy as it is one of the few threat actors specifically targeting one industry: education. Since April, Arete has observed that 70% of Fog victims have been education organizations. This spotlight explores the ransomware group’s observed behavior, background information on the threat actor, and statistics from Incident Response engagements, along with a technical analysis of Fog’s ransomware executable. Finally, we discuss security recommendations to better defend against this evolving cyber threat and mitigate the risk of financial and reputation losses.

Incident Response Data on the Fog Ransomware Group

The information below is based on Fog ransomware incidents investigated by Arete since April 2024. Our IR, Threat Intelligence, and Data Analytics teams work together to analyze key data points during every ransomware engagement and form real-time threat actor (TA) insights.

• The median initial demand is $220,000.

• The median ransom payment facilitated is $100,000.

• 36% of engagements involved data exfiltration, often using tools like MEGAsync and Filezilla.

• Common initial access vectors include brute force attacks against remote desktop protocol (RDP) and compromised virtual private network (VPN) credentials.

• Tools observed during investigations include CobaltStrike, Mimikatz, ngrok, WinRAR, AnyDesk, Advanced Port Scanner, and GMER, among others. The group demonstrates distinct skill in evading common anti-malware defenses.

• The ransom note file name is commonly “readme.txt” and includes a link to a TOR site used for negotiations.

• The group operates a data leak site (DLS) self-proclaimed as “The Fog Blog.”

Background

Fog ransomware was a prominent newcomer in the second quarter (Q2) of 2024 and demonstrated a noticeable trend of attacking entities in the education sector. Arete engagements involving Fog ransomware more than doubled during July 2024 compared to previous months.

Technical Analysis

Malware analysis revealed that Fog ransomware:

• Supports multiple command-line arguments.

• Encrypts files on the system and mounted shares.

• Adds the following extensions to encrypted files: .fog, .ffog, or .flocked (e.g., file.docx.flocked).

• Creates a ransom note with the following filename: readme.txt.

• Self-identifies the group as Fog in the ransom note.

• References a data leak site in the ransom note that, when accessed, self-identifies the group as Fog.

• Kills a list of processes and services.

• Maintains a list of whitelisted files and directories to make sure it will not render the system unusable, preventing recovery when running a decryptor.

• Attempts to prevent system recovery by deleting the system’s volume shadow copies.

• Creates a mutex during execution.

• Creates a log file named DbgLog.sys.Execution Pattern/Arguments

Fog ransomware needs command line arguments to execute and encrypt files in the system. Command line arguments supported:

The ransomware will not execute in the system without the “-id” argument followed by a 6-character value that is unique in each engagement.

Execution of the ransomware to encrypt files:

Figure 1. Code in the ransomware to check command line argument “-ID”

The ransomware uses the “-id” argument followed by a 6-character value to decrypt a JSON-based ransomware configuration information at runtime. Decrypted JSON field name and descriptions:

Stop Services and Processes

Before file encryption, the ransomware terminates a pre-determined list of processes and services to encrypt as many files as possible.

Process names:

Service names:

Code in the ransomware showing this operation:

Figure 2. Process termination decompiled code

Figure 3. Service termination decompiled code

File and Directory Exclusions

The ransomware excludes system-related files and folders, ransomware-related files, and whitelisted extensions during encryption.

Excluded file extensions:

Excluded directories:

Inhibit System Recovery

Windows operating systems contain features that can help fix corrupted system files, including shadow copies, which are backups of files created by the Volume Shadow Copy Service (VSS). By deleting shadow copies, the ransomware can prevent victims from restoring files from backups, making it more difficult for them to recover their data without paying the ransom.

The ransomware deletes volume shadow copies before file encryption by starting the following process:

System Network Connections Discovery

Fog ransomware can enumerate network-mounted shares by scanning the network interfaces.

Data Encrypted for Impact

The ransomware initially finds available drives and then loads the files one by one using the Windows API FindFirstFileW and FindNextFileW. The ransomware generates random AES keys to encrypt the files, and after encrypting them, the keys are encrypted using a public RSA key. The resulting key is again encrypted and placed at the end of the file.

Figure 4. Data encryption code

Figure 5. Extension added to the encrypted files

Figure 6. Encrypted AES key appended to encrypted file.

Fog ransomware extensions observed:

During execution, the ransomware creates a file named DbgLog.sys in the same directory and logs the ransomware activity. If the “-log” argument is used during ransomware execution, the ransomware creates and encrypts a lock_log.txt file under the C:\ProgramData directory. Encrypting the lock_log.txt file created might be an oversight in the ransomware code possibly indicating that the ransomware is still under development.

Figure 7. Log file created by the ransomware.

Upon successful execution, the ransomware creates ransom notes with the file name readme.txt.

Figure 8. Fog ransom note

Ransom note content:

Modify Registry

The ransomware did not perform any registry key modification.

Mutex

The mutex is the fundamental tool for managing shared resources between multiple threads or processes. Typically, ransomware uses a mutex to avoid reinfecting the victim system and causing multiple layers of encryption. The ransomware creates the following mutex value: XDLJgan1TkNkWfrQ78xVrust07YDq45X.

Figure 9. Mutex value created while debugging the ransomware

Network Activity

The ransomware did not try to communicate with a remote server other than encrypting data from mounted shares.

Indicators of Compromise

Data Leak Site

The ransom note contains a data leak site (DLS) that, when accessed, displayed the following page, self-identifying the group as Fog:

Figure 10. TOR DLS: xbkv2qey6u3gd3qxcojynrt4h5sgrhkar6whuo74wo63hijnn677jnyd[.]onion

Detection Mechanisms

Custom Detections and Blocking with Arete Bloktd℠

SentinelOne S1QL 1.0 query syntax (STAR rule):

Fog Ransomware

EndpointOS = ″Windows″ AND
( (ObjectType = ″Process″ AND SrcProcCmdLine RegExp ″\\.exe\\s{1,3}\\-id\\s{1,3}[a-zA-Z0-9]
{6}″) OR (ObjectType = ″File″ AND EventType In (″File Creation″, ″File Scan″) AND
TgtFilePath Contains Anycase ″\\

EndpointOS = ″Windows″ AND
( (ObjectType = ″Process″ AND SrcProcCmdLine RegExp ″\\.exe\\s{1,3}\\-id\\s{1,3}[a-zA-Z0-9]
{6}″) OR (ObjectType = ″File″ AND EventType In (″File Creation″, ″File Scan″) AND
TgtFilePath Contains Anycase ″\\

EndpointOS = ″Windows″ AND
( (ObjectType = ″Process″ AND SrcProcCmdLine RegExp ″\\.exe\\s{1,3}\\-id\\s{1,3}[a-zA-Z0-9]
{6}″) OR (ObjectType = ″File″ AND EventType In (″File Creation″, ″File Scan″) AND
TgtFilePath Contains Anycase ″\\

Akira Ransomware

Note: These threat hunting queries may need to be tuned for your specific network environment.

Yara

Recommended Mitigations

• Utilize an endpoint detection and response (EDR) solution with the capability to halt detected processes and isolate systems on the network based on identified conditions.

• Block any known attacker C2s in the firewall.

• Implement multi-factor authentication on RDP and VPN to restrict access to critical network resources.

• Eliminate unnecessary RDP ports exposed to the internet.

• Block a high number of SMB connection attempts from one system to others in the network over a short period of time.

• Perform periodic dark web monitoring to verify if data is available for sale on the black market.

• Perform penetration tests.

• Periodically patch systems and update tools.

• Monitor connections to the network from suspicious locations.

• Monitor downloads and uploads of files to file-sharing services outside standard work hours.

• Monitor file uploads from domain controllers to the internet.

• Monitor network scans from uncommon servers (e.g., RDP server).

Organizations can find the full list of US government-recommended ransomware prevention and mitigation guidance here: https://www.cisa.gov/stopransomware/ransomware-guide.

Arete provides data-driven cybersecurity solutions to transform your response to emerging cyber threats. Learn more.

References

• Unmasking Fog: Ransomware Threats in K-12 Education

At Arete, we envision a world without cyber extortion, where people, businesses, and governments can thrive. We are taking all that we know from over 8,000 engagements to inform our solutions and strengthen powerful tools to better prevent, detect, and respond to the cyber extortion threats of tomorrow. Our elite team of experts provides unparalleled capabilities to address the entire cyber threat lifecycle, from incident response and restoration to advisory and managed security services. To learn more about our solutions, visit www.areteir.com.