Fog Ransomware Uses DOGE-Themed Notes to Mock Victims in Growing Attacks

In the ever-evolving world of cybersecurity threats, a new ransomware campaign has emerged that uses a particularly unusual tactic: mocking its victims with DOGE-themed ransom notes. The latest operations from Fog ransomware, a growing cyber threat, have been wreaking havoc since early 2025, affecting over 100 organizations so far. The attack vectors have evolved from traditional methods, and this time, attackers are adding insult to injury by playing into the memes of the internet. Here’s an in-depth look at this strange and dangerous trend.

Fog Ransomware Campaigns: A Rise in Victim Count and Evolving Tactics

Fog ransomware operators have steadily escalated their attacks, now targeting victims with a fresh strategy that involves a bizarre DOGE-themed ransom note. The attacks, which started earlier this year, show a sharp increase in the number of affected organizations. As of April 2025, over 100 victims have been reported, with February 2025 witnessing a particularly intense spike—53 victims in a single month. The sectors most impacted by this ransomware wave include technology, manufacturing, education, and transportation, with most targets concentrated in the United States.

The latest attacks, uncovered by Trend Micro researchers, differ from earlier Fog campaigns, which typically relied on compromised VPN credentials to gain initial access. This time, however, the attackers are using phishing emails containing a zip file titled “Pay Adjustment.zip.” When the victim opens the file, a malicious LNK file is executed, which then triggers a series of actions that ultimately deploy the ransomware onto the system.

Once installed, the ransomware makes use of PowerShell scripts and other tools that harvest information about the victim’s system. These scripts can also facilitate lateral movement within the compromised network, allowing the attacker to move from one machine to another. The ransom note that follows is what truly distinguishes this new campaign. It includes a mix of satire and mockery, referencing the DOGE meme—a cryptocurrency-related joke popularized by Elon Musk’s Department of Government Efficiency (DOGE). The note asks victims to complete absurd tasks like listing five achievements from the past week or pay a trillion dollars in ransom.

Interestingly, the note offers a way out: If the victim successfully spreads the malware to someone else, they might receive a free decryption key. This bizarre demand is not just a quirky touch; it signals an increasingly sophisticated approach from Fog operators, who now appear to be incorporating double-extortion tactics into their attacks.

What Undercode Says: Analyzing the Shift in Tactics

Fog ransomware, once primarily focused on a quick payout through rapid encryption of files, seems to have matured in its operations. This new phase of attacks reveals a significant shift in strategy. Initially, Fog operators avoided exfiltrating data and instead focused on encrypting files for ransom. However, with the latest campaigns, data theft has become an integral part of the attack.

By incorporating double-extortion tactics—where attackers first steal sensitive data before encrypting it—Fog is now applying more pressure on victims to pay. This move mirrors the tactics used by other prominent ransomware groups, signaling that Fog is becoming more sophisticated and dangerous.

Moreover, the use of DOGE-themed ransom notes, while humorous, has a deeper psychological effect. It adds an element of mockery that not only frustrates victims but also may discourage them from reporting the incident. The absurdity of the ransom demands could cause some victims to second-guess their response, making it harder to measure the true impact of the attack.

This development also points to a broader trend in ransomware operations: a shift towards utilizing more diverse and personalized tactics to reach victims. The traditional approach of demanding a flat ransom is giving way to more creative demands, such as the one seen with Fog’s request for malware to be spread in exchange for a decryption key. This is indicative of the increasing need for cybersecurity defenses that can anticipate such innovations in threat activity.

With its evolving techniques, Fog ransomware underscores a larger issue within cybersecurity: the rapid pace at which cybercriminals adapt to new technologies and exploit emerging vulnerabilities. Organizations are now faced with more complex and sophisticated threats, and it’s clear that relying on outdated defenses is no longer enough to stay ahead.

Fact Checker Results:

The research conducted by Trend Micro and other cybersecurity firms confirms that over 100 victims have been reported, particularly in February 2025.
While some researchers initially believed Fog ransomware was only focused on quick encryptions, data theft and double-extortion tactics have become more prominent in recent attacks.
The use of DOGE-themed ransom notes is a novel approach that blends cybercrime with internet culture, increasing the complexity of identifying and mitigating the attack.