fog
RansomwareAbout the group
Fog, which uses the .flocked extension for encrypted files, was first observed in May in campaigns by Storm-0844, a threat actor known for distributing Akira. By June, Storm-0844 was deploying Fog more than Akira.
Exploited vulnerabilities
No CVEs attributed to this group in public sources (MITRE ATT&CK). Absence of attribution does not mean absence of activity.
Impact and victims
The group fog has 6 known ransomware victims. See the most affected sectors and countries and recent victims.
6known victims
6in Brazil
5sectors hit
Most attacked sectors
Manufacturing2
Professional Services1
Retail & E-Commerce1
Technology1
Transportation1
Most affected countries
🇧🇷 Brasil6
Recent victims
Pampili (pampili.com.br)
Grupo Baston Aerossol (baston.com.br)
Top Systems
Industria e Comercio Jolitex Ltda (jolitex.com)
Ouro Verde (ouroverde.net.br)
GSR Andrade Architects (gsr-andrade.com)
fog uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.
Explore the AI Autonomous Pentest →