Skip to content

fog

Inactive

25 tracked victims · First seen Dec 20, 2021 · Last seen Mar 20, 2025

About

Aggregated threat-intel description

Fog, which uses the .flocked extension for encrypted files, was first observed in May in campaigns by Storm-0844, a threat actor known for distributing Akira. By June, Storm-0844 was deploying Fog more than Akira.

Sectors: Technology, Business Services, Education · Countries: US, DE, FR

Recent victims

View all →
VictimSectorCountryPostedStatus
Newtown Friends School (newtownfriends.org)EducationUSMar 20, 2025
RAE (Real Academia Española) (rae.es)EducationESMar 17, 2025
University Diagnostic Medical Imaging, PC (udmi.net)HealthcareUSMar 13, 2025
El Camino Real Academy (elcaminorealacademy)EducationMar 13, 2025
Wilkinson Rogers (wilkinsonrogers.com)Not FoundMar 11, 2025
Magnolia Manor (magnoliamanor.com)HealthcareUSMar 10, 2025
WJCC Public Schools (wjccschools.org)EducationUSMar 6, 2025
Oberlin Cable Co-op (oberlin.net)TelecommunicationUSMar 6, 2025
1X InternetTechnologyDEMar 6, 2025
BizcodeNot FoundITMar 6, 2025
Manning Publications Co.Not FoundUSMar 6, 2025
EngikamNot FoundMar 6, 2025
FHNWEducationCHMar 6, 2025
AeonsparxNot FoundMYMar 6, 2025
CIENot FoundCZMar 6, 2025
Flightsim studioTechnologyMar 6, 2025
NeopolyNot FoundDEMar 6, 2025
Kr3mNot FoundDEMar 6, 2025
InfoReachTechnologyUSMar 6, 2025
EuranovaNot FoundBEMar 6, 2025
InelmaticTechnologyESMar 6, 2025
KotlivaNot FoundRUMar 6, 2025
InetNot FoundTHMar 6, 2025
Blue PlanetNot FoundMar 6, 2025
EumetsatTechnologyDEMar 6, 2025

All ransomware groups · Dark web intelligence