Report
Malware Spotlight: Fog Ransomware
Arete Analysis
Tips
Cybersecurity Trends
Download The Report
Executive Summary
Since April 2024, Arete’s Incident Response (IR) team has responded to multiple engagements attributed to the Fog ransomware group. Engagements attributed to this group have been trending up since mid-June and through July 2024, accounting for nearly 20% of Arete’s ransomware and extortion engagements in July. The Fog ransomware group is especially noteworthy as it is one of the few threat actors specifically targeting one industry: education. Since April, Arete has observed that 70% of Fog victims have been education organizations. This spotlight explores the ransomware group’s observed behavior, background information on the threat actor, and statistics from Incident Response engagements, along with a technical analysis of Fog’s ransomware executable. Finally, we discuss security recommendations to better defend against this evolving cyber threat and mitigate the risk of financial and reputation losses.
Incident Response Data on the Fog Ransomware Group
The information below is based on Fog ransomware incidents investigated by Arete since April 2024. Our IR, Threat Intelligence, and Data Analytics teams work together to analyze key data points during every ransomware engagement and form real-time threat actor (TA) insights.
The median initial demand is $220,000.
The median ransom payment facilitated is $100,000.
36% of engagements involved data exfiltration, often using tools like MEGAsync and Filezilla.
Common initial access vectors include brute force attacks against remote desktop protocol (RDP) and compromised virtual private network (VPN) credentials.
Tools observed during investigations include CobaltStrike, Mimikatz, ngrok, WinRAR, AnyDesk, Advanced Port Scanner, and GMER, among others. The group demonstrates distinct skill in evading common anti-malware defenses.
The ransom note file name is commonly “readme.txt” and includes a link to a TOR site used for negotiations.
The group operates a data leak site (DLS) self-proclaimed as “The Fog Blog.”
Background
Fog ransomware was a prominent newcomer in the second quarter (Q2) of 2024 and demonstrated a noticeable trend of attacking entities in the education sector. Arete engagements involving Fog ransomware more than doubled during July 2024 compared to previous months.
Technical Analysis
Malware analysis revealed that Fog ransomware:
Supports multiple command-line arguments.
Encrypts files on the system and mounted shares.
Adds the following extensions to encrypted files: .fog, .ffog, or .flocked (e.g., file.docx.flocked).
Creates a ransom note with the following filename: readme.txt.
Self-identifies the group as Fog in the ransom note.
References a data leak site in the ransom note that, when accessed, self-identifies the group as Fog.
Kills a list of processes and services.
Maintains a list of whitelisted files and directories to make sure it will not render the system unusable, preventing recovery when running a decryptor.
Attempts to prevent system recovery by deleting the system’s volume shadow copies.
Creates a mutex during execution.
Creates a log file named DbgLog.sys.Execution Pattern/Arguments
Fog ransomware needs command line arguments to execute and encrypt files in the system. Command line arguments supported:
Command line arguments | Description |
|---|---|
-id | Key to decrypt ransomware configuration. |
-nomutex | Skip mutex check. |
-target | Specific location to encrypt files. |
-console | Creates a new console window for output. |
-size | File size threshold to encrypt. |
-log | Log the ransomware activity. |
-procoff | Presently unknown. |
-uncoff | Presently unknown. |
The ransomware will not execute in the system without the “-id” argument followed by a 6-character value that is unique in each engagement.
Execution of the ransomware to encrypt files:
Fog.exe -id [6-characters] Example: | ||
|---|---|---|
Figure 1. Code in the ransomware to check command line argument “-ID”
The ransomware uses the “-id” argument followed by a 6-character value to decrypt a JSON-based ransomware configuration information at runtime. Decrypted JSON field name and descriptions:
Name | Description |
|---|---|
RSAPubKey | Public key used in the file encryption process. |
LockedExt | Extension added to encrypted files. |
NoteFileName | Ransom note name. |
PathStopList | Excludes listed directories. |
FileMaskStopList | Excludes listed file extensions. |
ShutdownProcesses | Terminates list of processes. |
ShutdownServices | Terminates list of services. |
Stop Services and Processes
Before file encryption, the ransomware terminates a pre-determined list of processes and services to encrypt as many files as possible.
Process names:
“notepad.exe”, “calc.exe”, “*sql*” | ||
|---|---|---|
Service names:
“Dhcp”, “Dnscache”, “*sql*” | ||
|---|---|---|
Code in the ransomware showing this operation:
Figure 2. Process termination decompiled code
Figure 3. Service termination decompiled code
File and Directory Exclusions
The ransomware excludes system-related files and folders, ransomware-related files, and whitelisted extensions during encryption.
Excluded file extensions:
“*.exe”, “*.dll”, “*.lnk”, “*.sys” | ||
|---|---|---|
Excluded directories:
“tmp”, “winnt”, “Application Data”, “AppData”, “temp”, “thumb”, “$Recycle.Bin”, “System Volume Information”, “Windows”, “Boot” | ||
|---|---|---|
Inhibit System Recovery
Windows operating systems contain features that can help fix corrupted system files, including shadow copies, which are backups of files created by the Volume Shadow Copy Service (VSS). By deleting shadow copies, the ransomware can prevent victims from restoring files from backups, making it more difficult for them to recover their data without paying the ransom.
The ransomware deletes volume shadow copies before file encryption by starting the following process:
cmd.exe /c vssadmin delete shadows /all /quiet | ||
|---|---|---|
System Network Connections Discovery
Fog ransomware can enumerate network-mounted shares by scanning the network interfaces.
Data Encrypted for Impact
The ransomware initially finds available drives and then loads the files one by one using the Windows API FindFirstFileW and FindNextFileW. The ransomware generates random AES keys to encrypt the files, and after encrypting them, the keys are encrypted using a public RSA key. The resulting key is again encrypted and placed at the end of the file.
Figure 4. Data encryption code
Figure 5. Extension added to the encrypted files
Figure 6. Encrypted AES key appended to encrypted file.
Fog ransomware extensions observed:
“.FOG”, “.FLOCKED”, “.FFOG” | ||
|---|---|---|
During execution, the ransomware creates a file named DbgLog.sys in the same directory and logs the ransomware activity. If the “-log” argument is used during ransomware execution, the ransomware creates and encrypts a lock_log.txt file under the C:\ProgramData directory. Encrypting the lock_log.txt file created might be an oversight in the ransomware code possibly indicating that the ransomware is still under development.
Figure 7. Log file created by the ransomware.
Upon successful execution, the ransomware creates ransom notes with the file name readme.txt.
Figure 8. Fog ransom note
Ransom note content:
If you are reading this, then you have been the victim of a cyber attack. We call ourselves Fog and we take responsibility for this incident. You can check out our blog where we post company data: xbkv2qey6u3g3dqxcoyjnrt4h5sgrhkar6whuo74wo63hijnn677jnyd[.]onion You might appear there if you opt out of our communication. We are the ones who encrypted your data and also copied some of it to our internal resource. The sooner you contact us, the sooner we can resolve this incident and get you back to work. To contact us you need to have Tor browser installed:
| ||
|---|---|---|
Modify Registry
The ransomware did not perform any registry key modification.
Mutex
The mutex is the fundamental tool for managing shared resources between multiple threads or processes. Typically, ransomware uses a mutex to avoid reinfecting the victim system and causing multiple layers of encryption. The ransomware creates the following mutex value: XDLJgan1TkNkWfrQ78xVrust07YDq45X.
Figure 9. Mutex value created while debugging the ransomware
Network Activity
The ransomware did not try to communicate with a remote server other than encrypting data from mounted shares.
Indicators of Compromise
Indicator | Type | Context |
|---|---|---|
B6360765c786ceee0eb28bee64709172b4e2e066449968e011390be1afd8f36c515edfedadb458be0f569fc2bedb6c4139782516d6faf464b4881739e312e9fabbE67260804526323484f564eebeb6c99ed021b960b899ff788aed85bb7a9d75c3e44c342198e0ad8dd8c0f7bda19d4deb33f0d8355e3e78827505c3b858c82d54 | SHA256 hash | Fog ransomware |
C:\readme.txt | File path | Fog ransom note |
.fog, .flocked, .ffog | Extension | Encrypted file extensions |
vssadmin delete shadows /all /quiet | Process | Volume Shadow Copy deletion |
XDLJgan1TkNkWfrQ78xVrust07YDq45X | Mutex | Mutex value objects created by the Fog ransomware |
xbkv2qey6u3g3dqxcoyjnrt4h5sgrhkar6whuo74wo63hijnn677jnyd[.]onion | URL | TA data leak site (DLS) |
Data Leak Site
The ransom note contains a data leak site (DLS) that, when accessed, displayed the following page, self-identifying the group as Fog:
Figure 10. TOR DLS: xbkv2qey6u3gd3qxcojynrt4h5sgrhkar6whuo74wo63hijnn677jnyd[.]onion
Detection Mechanisms
Custom Detections and Blocking with Arete’s Arsenal
SentinelOne S1QL 1.0 query syntax (STAR rule):
Fog Ransomware
Akira Ransomware
Note: These threat hunting queries may need to be tuned for your specific network environment.
Yara
Recommended Mitigations
Utilize an endpoint detection and response (EDR) solution with the capability to halt detected processes and isolate systems on the network based on identified conditions.
Block any known attacker C2s in the firewall.
Implement multi-factor authentication on RDP and VPN to restrict access to critical network resources.
Eliminate unnecessary RDP ports exposed to the internet.
Block a high number of SMB connection attempts from one system to others in the network over a short period of time.
Perform periodic dark web monitoring to verify if data is available for sale on the black market.
Perform penetration tests.
Periodically patch systems and update tools.
Monitor connections to the network from suspicious locations.
Monitor downloads and uploads of files to file-sharing services outside standard work hours.
Monitor file uploads from domain controllers to the internet.
Monitor network scans from uncommon servers (e.g., RDP server).
Organizations can find the full list of US government-recommended ransomware prevention and mitigation guidance here: https://www.cisa.gov/stopransomware/ransomware-guide.
Arete provides data-driven cybersecurity solutions to transform your response to emerging cyber threats. Learn more.
References
At Arete, we envision a world without cyber extortion, where people, businesses, and governments can thrive. We are taking all that we know from over 8,000 engagements to inform our solutions and strengthen powerful tools to better prevent, detect, and respond to the cyber extortion threats of tomorrow. Our elite team of experts provides unparalleled capabilities to address the entire cyber threat lifecycle, from incident response and restoration to advisory and managed security services. To learn more about our solutions, visit www.areteir.com.
Back to Blog Posts
Article
Phishing-as-a-Service Evolves with Venom
“Whaling” has taken on a new meaning with a highly targeted phishing campaign active from November 2025 through March 2026, aimed exclusively at senior executives from more than 20 industries. The campaign, dubbed VENOM, is a phishing-as-a-service (PhaaS) platform that combines advanced evasion capabilities with immediate persistence of targeted executives. The initial phish impersonates an internal SharePoint document notification and uses embedded QR codes to convince victims to shift to unmanaged mobile devices to bypass corporate security controls. VENOM aims to establish persistence immediately by either registering a new MFA device or retaining long-lived refresh tokens, allowing threat actors to maintain access even after password resets or other base-level remediation efforts.
What’s Notable and Unique
This campaign is unique in its targeted nature of the PhaaS platform rather than broad, sweeping attempts. The threat actors behind VENOM create convincing phishing emails that impersonate SharePoint activity using the victim’s own domain, company name, and even fabricated email threads. These convincing social engineering tactics, combined with the specific targeting of executives, make this an effective capability for cybercriminals.
VENOM operates as a closed-access system, with full adversarial support, but has no public visibility on the dark web or from security researchers. The service likely operates on an invite-only basis, unlike most PhaaS platforms, which typically seek to have as many paying customers as possible. This, among other items such as the sophisticated evasion techniques, indicates a higher degree of sophistication than most other PhaaS offerings.
Either through MFA enrollment or Microsoft Device Code abuse, the threat actor forces the victim to aid them in establishing persistence early in the attack lifecycle. These tactics result in either valid tokens or an additional MFA login method controlled by the threat actor, meaning typical password resets alone are not effective against this technique. Administrators would be required to explicitly revoke sessions and token grants to mitigate the threat actors’ persistence.
Analyst Comments
Oftentimes, MFA is viewed as a one-stop shop to cybersecurity, but tactics such as this show how threat actors can bypass MFA, or worse, use it to establish persistence. Ultimately, this campaign highlights how modern attacks increasingly abuse legitimate authentication workflows rather than attempting to defeat them outright. Defenses that rely solely on MFA without other security posturing, such as continuous session monitoring, token revocation, and identity logging, can leave organizations vulnerable. As attackers shift toward token theft and device trust abuse, incident response and identity security strategies must evolve accordingly.
Sources
Meet VENOM: The PhaaS Platform That Neutralizes MFA
Article
Threat Actors Continue to Leverage BYOVD Technique
Multiple ransomware operations have recently been observed leveraging the Bring Your Own Vulnerable Driver (BYOVD) technique to disable endpoint security controls prior to ransomware deployment. Notably, the Qilin ransomware group commonly leverages a malicious msimg32.dll file loaded via DLL side-loading, along with vulnerable drivers including rwdrv.sys and hlpdrv.sys, to gain kernel-level access and disable security processes. Similarly, Warlock ransomware has been observed exploiting the vulnerable NSecKrnl.sys driver to bypass security controls. The use of BYOVD has also been observed across ransomware campaigns associated with Akira, INC, Medusa, and other threat actors.
What’s Notable and Unique
The Qilin ransomware group employs a sophisticated multi-stage infection chain, leveraging DLL side-loading (msimg32.dll) to execute malicious payloads directly in memory and evade traditional file-based detection. In DLL side-loading, a threat actor tricks a program into loading a malicious dynamic link library. The malware escalates privileges and uses signed but vulnerable drivers (rwdrv.sys and hlpdrv.sys) to bypass security controls, access system memory, and systematically disable endpoint defenses by terminating security processes and disabling monitoring callbacks at the kernel level.
Akira ransomware operators have also exploited the rwdrv.sys and hlpdrv.sys drivers. Additionally, Arete has observed threat actors leveraging multiple other drivers, including the vulnerable TrueSight.sys, to bypass security controls.
Meanwhile, Warlock ransomware operators disguised malicious activity by renaming rclone.exe to TrendSecurity.exe to appear legitimate. The file functioned as a loader, exploiting the vulnerable NSecKrnl.sys driver to disable security processes, while Group Policy Objects (GPOs) were leveraged to systematically disable security controls across the environment.
Analyst Comments
The BYOVD technique, employed by multiple known ransomware operators, reflects a broader shift toward pre-encryption defense evasion, including suppression of Windows telemetry, removal of monitoring callbacks, and abuse of legitimately signed but vulnerable drivers. This technique enables threat actors to evade detection, maintain persistence for extended periods, and maximize the operational impact of ransomware deployment across compromised environments. Organizations should implement strict driver control policies, such as Microsoft’s Vulnerable Driver Blocklist and application control mechanisms. Additionally, enforcing least privilege access, enabling multi-factor authentication (MFA), maintaining up-to-date patching, and continuously monitoring for anomalous driver and kernel-level activity can further reduce the risk of such attacks.
Sources
Qilin EDR killer infection chain
Web Shells, Tunnels, and Ransomware: Dissecting a Warlock Attack
Article
Ransomware Trends & Data Insights: March 2026
The threat landscape in March had a much more even distribution of threat groups than has been observed since the first half of 2025. Although Akira, Qilin, Play, and INC remained among the most active groups, Arete observed 21 unique ransomware and extortion groups in March, compared to only 15 in February. Akira and Qilin’s activity also declined from the previous month; in February, the two groups were responsible for almost half of all ransomware incidents, but in March they only comprised a little more than a quarter of all activity. Arete also observed activity from several emerging groups in the past month, including BravoX, NightSpire, Payouts King, and Securotrop.
Figure 1. Activity from the top 5 threat groups in March 2026
Analysts at Arete identified several trends behind the threat actors perpetrating cybercrime activities:
In March, threat actors actively exploited FortiGate Next-Generation Firewall appliances as initial access vectors to compromise enterprise networks. The activity involves the exploitation of recently disclosed security vulnerabilities, including CVE-2025-59718, CVE-2025-59719, and CVE-2026-24858, or weak credentials, allowing attackers to gain administrative access, extract configuration files, and obtain service account credentials. Arete also observed Fortinet device exploitation involving various threat groups, with the Qilin ransomware group notably leveraging Fortinet device exploits.
Phishing campaigns leveraging OAuth redirection and a resurgence of Microsoft Teams–based social engineering were also observed in March. In one campaign, attackers sent emails disguised as Microsoft Teams recordings or Microsoft 365 alerts, redirecting victims through legitimate OAuth endpoints to attacker-controlled pages hosting malicious ZIP payloads. A separate campaign has been ongoing since last year, in which attackers flood users’ inboxes with spam and impersonate IT support personnel to trick victims into initiating remote support sessions via tools like Quick Assist.
Arete recently released its 2025 Annual Crimeware Report. Leveraging data and intelligence collected during ransomware and extortion incident response engagements, this report highlights notable trends and shifts in the threat landscape throughout 2025, including Akira’s unusually high activity levels in the second half of 2025, evolving social engineering techniques, and trends in ransom demands and impacted industries.
Sources
Arete Internal
Report
Arete's 2025 Annual Crimeware Report
Harness Arete’s unique data and expertise on extortion and ransomware to inform your response to the evolving threat landscape.