FOG Ransomware Masquerades Behind DOGE Branding in Sophisticated Phishing Campaigns

Introduction:

In a chilling evolution of ransomware tactics, cybercriminals are now exploiting government-related branding to lend credibility to their phishing attacks. The latest target? The Department of Government Efficiency (DOGE), a real U.S. government initiative, now falsely associated with a wave of malware-laced phishing campaigns. At the center of this campaign is FOG ransomware—a sophisticated, fast-growing cyber threat that has already victimized over a hundred organizations in 2025 alone.

Disguised within seemingly harmless ZIP files labeled “Pay Adjustment.zip,” the FOG ransomware is delivered via phishing emails. Once opened, these files trigger a cascade of malicious scripts, ultimately stealing system information, exfiltrating data, and demanding payment through encrypted notes. Behind the curtain, this ransomware operation reveals calculated impersonation, deception, and growing technical complexity, posing serious implications for enterprise cybersecurity.

The Key Findings Unfolded:

Nine new samples of FOG ransomware were uploaded to VirusTotal between March 27 and April 2, 2025.
These samples were distributed via phishing emails containing a ZIP file named “Pay Adjustment.zip”.
Inside this ZIP file lies a malicious LNK shortcut file, executing PowerShell scripts to start the ransomware infection chain.
The scripts download a loader (cwiper.exe) and additional tools like ktool.exe, which exploits an Intel network driver vulnerability.
Trend Vision One™ detected and blocked all the FOG ransomware variants discussed, providing layered protection and threat intelligence tools to customers.
The ransomware drops a readme.txt ransom note containing politically charged messages and DOGE branding—possibly as trolling or impersonation.
Once installed, FOG ransomware harvests a broad range of data including IP addresses, geolocation, MAC addresses, CPU configuration, and more.
It even sends data to a Netlify-hosted site: hxxps://hilarious-trifle-d9182e.netlify[.]app.
QR codes embedded in the ransom note direct victims to Monero wallets, further obscuring attackers’ identities.
The ransomware uses sandbox evasion techniques like checking processor count and memory size before execution.
Victims span several sectors including technology, education, healthcare, manufacturing, transportation, retail, and more.
The attackers may be using DOGE branding to troll authorities or confuse attribution.
Payload files are often encrypted with XOR-encoded base64 scripts, enhancing evasion.
FOG ransomware operations have affected 173 Trend customers since June 2024.
It’s believed these campaigns could be launched by the original FOG group or copycats mimicking their tactics.
Ransom notes also include instructions for spreading the malware, suggesting lateral movement capabilities.
Security professionals are encouraged to track Indicators of Compromise (IoCs) and use threat-hunting tools.
Trend Vision One provides real-time Threat Insights, intelligence reports, and hunting queries to stay proactive.
One of the dropper’s techniques involves decrypting embedded binaries in-memory before activating them.
The malware leverages a vulnerable driver (iQVW64.sys) for privilege escalation.
A log file (dbgLog.sys) is dropped to track encryption-related activity, aiding forensic analysis.
Trend’s telemetry shows a surge of activity in February, with 53 victims—the highest in a single month.
The infection chain highlights the use of staged payload delivery and command chaining through PowerShell.
Companies are urged to train employees, maintain segmented networks, and conduct frequent backups.
Regular software patching is critical to close exploitable vulnerabilities used by such ransomware groups.
Detection of files with .flocked extension and readme.txt ransom notes are major infection indicators.
The attacks’ political overtones and use of DOGE references add a layer of psychological manipulation.
Trend’s data reveals that FOG’s codebase has evolved, though the core encryption mechanisms remain consistent.

What Undercode Say:

The resurgence of FOG ransomware—now cleverly disguised behind DOGE branding—is a textbook example of social engineering fused with technical sophistication. By leveraging real-world government affiliations, the threat actors amplify the perceived legitimacy of their phishing campaigns, increasing the chances of infection. This isn’t just a prank or a troll—it’s calculated manipulation.

The impersonation of DOGE could serve multiple purposes. First, it’s likely an attempt to draw media attention, exploiting political noise for distraction and misdirection. Secondly, it may create confusion in attribution, making investigators chase false leads. It’s even plausible this move intends to taunt government agencies or retaliate against regulatory scrutiny.

From a technical standpoint, FOG ransomware is evolving rapidly. Its layered infection process, sandbox evasion tactics, and privilege escalation via vulnerable drivers signal a level of sophistication that rivals many APT groups. The use of PowerShell for every major stage of the attack—right from initial access to payload deployment—demonstrates deep understanding of native Windows tooling. This grants it both stealth and adaptability.

The presence of multiple encoded, obfuscated scripts (some base64 with XOR encryption) complicates reverse engineering. The malware’s ability to collect granular system information and geolocation details shows it’s engineered not just for quick gains but also for long-term operational intelligence.

Its data exfiltration to obscure domains hosted on Netlify, and the use of Monero wallets, reveal a growing trend among ransomware actors: decentralization of infrastructure to avoid takedowns. These choices also make threat attribution more difficult, further blurring the lines between various threat actor groups.

The victims span across essential verticals, including healthcare, education, and transportation—critical industries where downtime is especially devastating. This reflects a shift in targeting strategy, focusing on entities with low tolerance for operational disruptions.

The fact that this ransomware uses QR codes embedded in ransom notes is particularly clever. It’s mobile-friendly, socially engineered for quick scanning, and adds an extra hurdle for analysis. This could push victims toward faster payment decisions, which benefits the attackers.

Despite all of this, the campaign has clear signs of being either a rebranded variant of an old threat group or a hybrid operation borrowing code from previous attacks. The reuse of the same encryption logging files, naming conventions, and PowerShell command chains all suggest legacy components still in use.

Trend Vision One’s proactive defense—including real-time hunting queries and actionable intelligence—is a prime example of how enterprises must adapt. In the face of polymorphic ransomware like FOG, static defenses are no longer sufficient. Continuous monitoring, adaptive AI-driven detection, and strong endpoint visibility are the only real solutions.

Fact Checker Results:

FOG ransomware is a real and active threat verified by multiple cybersecurity sources.
The impersonation of DOGE is not officially linked to the department but used as a decoy or troll tactic.
Trend Vision One’s detections and threat intelligence have successfully identified and blocked these campaigns.