Fog

Inactive

Fog, which uses the .flocked extension for encrypted files, was first observed in May in campaigns by Storm-0844, a threat actor known for distributing Akira. By June, Storm-0844 was deploying Fog more than Akira.

189 Victims

Dec 19, 2021 First Discovered

Mar 19, 2025 Last Discovered

591 Days Inactive

0% Infostealer

0/2 Sites Online

Known Locations (2)

Blog

xbkv2qey6u3gd3qxcojynrt4h5sgrhkar6whuo74wo63hijnn677jnyd.onion

500 Internal Server Error

xql562evsy7njcsngacphc2erzjfecwotdkobn3m4uxu2gtqh26newid.onion

Tools Used

CredentialTheft

DonPAPI, Veeam-Get-Creds

DiscoveryEnum

Advanced Port Scanner, SharpShares, SoftPerfect NetScan

LOLBAS

PsExec

Networking

Powercat, Proxychains

Offsec

Certipy, Impacket, Metasploit, NetExec, Orpheus, Sliver, Zer0dump

RMM-Tools

AnyDesk

Intelligence

6 Negotiation Chats

📄 2 Ransom Notes
View the actual ransom notes used by this group →

Victims (189)

Detailed victim list temporarily unavailable

This group has 189 victims. The victim list API is currently responding slowly for this dataset. Country, sector, and infostealer breakdowns are not available at this time. Basic stats (victim count, first/last seen) are shown above from a faster data source.