Skip to main content
Darkfield

Operator dossier

Fog is a ransomware operator no longer publishing new disclosures. Darkfield has indexed 189 public victims claimed by this operator between July 16, 2024 and March 20, 2025. Fog is a relatively new ransomware group that emerged in July 2024, operating with apparent financial motivations and demonstrating rapid expansion in their victim targeting across multiple geographic regions and industry sectors. The group's origin and specific affiliations remain unclear due to their recent emergence, though their operational patterns suggest they likely operate independently rather than as part of an established Ransomware-as-a-Service ecosystem. Given the limited public documentation from major security agencies and researchers due to the group's recent appearance, specific details about their attack methodology, initial access vectors, and encryption techniques have not yet been comprehensively analyzed or reported by authoritative sources such as CISA, FBI, or major threat intelligence firms. The group has reportedly victimized 189 organizations primarily across the United States, Germany, France, Australia, and Brazil, with their attacks predominantly targeting the technology sector, followed by education, business services, and manufacturing industries, though no specific high-profile campaigns or record ransom demands have been publicly documented by major security researchers at this time. As of current reporting, Fog appears to remain active given their recent emergence and ongoing victim acquisition patterns observed throughout 2024.

Most-targeted sectors

Most-affected countries

Recent disclosures by Fog

Most recent 150 of 189 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for Fog →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Inactive ransomware operator

← All groups

Fog

189 victims indexed · first seen 2 years ago · last activity 1 year ago

189
Victims indexed
#41 of 364 tracked operators
8m
Active period
Jul 2024 → Mar 2025
10
Countries hit
top United States · 75

At a glance

Status
inactive
First seen
2 years ago
Last activity
1 year ago
Onion sites
5 known endpoints
Primary sector
Technology · 37 hits

About

Fog is a relatively new ransomware group that emerged in July 2024, operating with apparent financial motivations and demonstrating rapid expansion in their victim targeting across multiple geographic regions and industry sectors. The group's origin and specific affiliations remain unclear due to their recent emergence, though their operational patterns suggest they likely operate independently rather than as part of an established Ransomware-as-a-Service ecosystem. Given the limited public documentation from major security agencies and researchers due to the group's recent appearance, specific details about their attack methodology, initial access vectors, and encryption techniques have not yet been comprehensively analyzed or reported by authoritative sources such as CISA, FBI, or major threat intelligence firms. The group has reportedly victimized 189 organizations primarily across the United States, Germany, France, Australia, and Brazil, with their attacks predominantly targeting the technology sector, followed by education, business services, and manufacturing industries, though no specific high-profile campaigns or record ransom demands have been publicly documented by major security researchers at this time. As of current reporting, Fog appears to remain active given their recent emergence and ongoing victim acquisition patterns observed throughout 2024.

References

9 links

External sources curated by the MISP threat-intel community.

Timeline

9 months
2024-07-01T00:00:00+00:00 · 112024-08-01T00:00:00+00:00 · 42024-09-01T00:00:00+00:00 · 52024-10-01T00:00:00+00:00 · 242024-11-01T00:00:00+00:00 · 202024-12-01T00:00:00+00:00 · 222025-01-01T00:00:00+00:00 · 112025-02-01T00:00:00+00:00 · 592025-03-01T00:00:00+00:00 · 33
2024-07-01T00:00:00+00:002025-03-01T00:00:00+00:00

Top countries

🇺🇸 United States
75
🇩🇪 Germany
15
🇫🇷 France
7
🇧🇷 Brazil
6
🇦🇺 Australia
6
🇧🇪 Belgium
5
🇨🇦 Canada
4
🇮🇩 Indonesia
4
United States dossier →Germany dossier →France dossier →Brazil dossier →

Top sectors

Technology
37
Education
26
Business Services
26
Manufacturing
22
Transportation/Logistics
9
Government
9
Healthcare
7
Agriculture and Food Production
6
Technology dossier →Education dossier →Business Services dossier →Manufacturing dossier →

MITRE ATT&CK

5 techniques · 4 tactics

Tactics

Initial AccessExecutionDefense EvasionImpact

Techniques

  • T1566Phishing
  • T1190Exploit Public-Facing Application
  • T1204User Execution
  • T1027Obfuscated Files or Information
  • T1486Data Encrypted for Impact

Recent victims

Loading…

Onion infrastructure

5 known
  • http://xbkv2qey6u3gd3qxcojynrt4h5sgrhkar6whuo74wo63hijnn677jnyd.onion
  • http://xbkv2qey6u3gd3qxcojynrt4h5sgrhkar6whuo74wo63hijnn677jnyd.onion/
  • http://xql562evsy7njcsngacphc2erzjfecwotdkobn3m4uxu2gtqh26newid.onion
  • http://xql562evsy7njcsngacphc2erzjfecwotdkobn3m4uxu2gtqh26newid.onion/
  • https://xql562evsy7njcsngacphc2erzjfecwotdkobn3m4uxu2gtqh26newid.onion/

Source

Updated 1 year ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time Fog posts a victim.

Add Fog to your watchlist — Pro pings you within 5 minutes of any new Fog leak-site post, Telegram callout, or affiliate-rebrand inference.