FOG Ransomware Expands Its Cyber Extortion Campaign Across 12 Countries

The notorious FOG ransomware group has significantly escalated its cyber extortion campaign, targeting organizations across 12 countries with a wave of attacks. By leaking sensitive data and source code from 19 new victims, the group’s activities have reached critical sectors, including semiconductor manufacturing, meteorological infrastructure, and federal agencies. This heightened global reach underscores the evolving sophistication and impact of ransomware attacks, particularly those employing the double extortion tactic. In this article, we break down the latest wave of attacks and provide insight into FOG’s tactics, techniques, and implications for cybersecurity.

FOG Ransomware Attacks

FOG ransomware’s latest campaign has involved leaking source code and sensitive data of 19 victims from 12 countries on their dark web portal, “The Fog Blog.” The targets span industries like semiconductor manufacturing, federal agencies, meteorological infrastructure, and academia. This attack pattern is consistent with FOG’s double extortion strategy, which includes encrypting systems and threatening to release stolen data unless ransoms are paid.

Notable victims include MELEXIS (Belgium), a semiconductor leader; the U.S. Geological Survey (USGS); EUMETSAT (Germany); and FHNW University (Switzerland). The group’s attacks also targeted emerging markets, with companies like Indonesia’s Koltiva and Spain’s Inelmatic Electronics suffering significant disruptions. FOG’s quick attack method, typically encrypting systems within hours, and its use of compromised VPN credentials and brute-forced RDP endpoints, allow it to act swiftly.

The victims represent critical sectors such as automotive, meteorology, education, and industrial manufacturing, where disruptions could have cascading effects. FOG’s median ransom demand is $220,000, and its reliance on double extortion heightens pressure on victims to pay.

What Undercode Says: Analyzing the Latest FOG Attacks

The latest wave of FOG ransomware attacks serves as a stark reminder of the growing sophistication and global reach of cybercriminals. The group’s expanding footprint across both developed and emerging markets highlights an evolving strategy—attacking not just high-profile companies but also key infrastructure sectors in vulnerable regions.

FOG’s targets, such as MELEXIS, represent industries where operational disruptions could reverberate through the global supply chain. For instance, semiconductor manufacturing is the backbone of numerous tech industries, and any disruption here can affect a wide array of industries dependent on electronic components. Similarly, EUMETSAT’s meteorological data is crucial for weather forecasting and climate research, making its compromise a security concern not only for Germany but for global weather systems and scientific research.

The inclusion of educational institutions, like FHNW University, also indicates a shift in focus toward sectors that are often under-resourced in terms of cybersecurity. These organizations may not have the same robust defenses as large corporations, making them attractive targets for ransomware groups. Additionally, the median ransom demand of $220,000 illustrates a trend toward larger ransom demands, which are more likely to be paid by organizations that depend on the confidentiality of their data or the smooth operation of their systems.

Technically, FOG ransomware continues to exploit known vulnerabilities, such as compromised VPN credentials and brute-forced RDP endpoints, to gain initial access. Once inside, the group uses advanced lateral movement techniques with tools like Advanced Port Scanner and PsExec. This highlights the importance of having strong access controls and monitoring for any unusual traffic patterns, particularly those involving VPN or RDP connections.

The group’s use of AES-256 encryption with RSA-2048 keys makes decryption without the private key virtually impossible. This level of encryption ensures that any data stolen or encrypted cannot be recovered without the threat actor’s cooperation, making it a highly effective tactic for demanding ransoms. As organizations increasingly shift to cloud environments, the targeting of virtual machine disks, such as those used by FlightSim Studio and 1xINTERNET, signals a new frontier in ransomware attacks, one that has the potential to disrupt critical cloud-based services.

One of the more concerning aspects of FOG’s attacks is the rapid execution time, with reports indicating that the group’s median dwell time before encryption is just two hours. This highlights the critical need for real-time detection systems and rapid response capabilities to prevent widespread damage. The use of decoy files or canary traps could help detect early-stage encryption activity, potentially giving organizations a head start in mitigating the attack.

Finally, FOG’s consistent use of double extortion tactics—where the ransomware group not only encrypts systems but also threatens to release stolen data—adds immense pressure on victims to comply. This dual threat creates a more difficult decision for organizations facing potential reputational damage in addition to operational disruptions. As ransomware attacks become more aggressive, organizations must adopt a proactive defense posture, including strong cybersecurity measures, regular offline backups, and, crucially, not yielding to ransom demands.

Fact Checker Results:

FOG ransomware group has been identified as targeting critical sectors with a history of fast execution times and operational disruption.
The technical methods employed, such as using brute-forced RDP credentials and advanced tools for lateral movement, align with documented cybercriminal strategies.
Regular offline backups and multi-factor authentication are recognized as effective measures to mitigate risks posed by this ransomware group.