fog
Fog, which uses the .flocked extension for encrypted files, was first observed in May in campaigns by Storm-0844, a threat actor known for distributing Akira. By June, Storm-0844 was deploying Fog more than Akira.
source: ransomware.live1 refs →
fog
Fog is a ransomware group operated by Storm-0844, known for using the .flocked file extension for encryption.
Analyst brief
Fog is a ransomware group that uses the .flocked extension for encrypted files, operated by Storm-0844, a threat actor previously known for distributing Akira ransomware. The actor primarily targets organizations for financial gain through ransomware operations. Key TTPs include file encryption, and while initial access vectors are not specified, they are likely associated with Storm-0844's established methods. Defenders should focus on detecting the .flocked file extension, creating detection rules based on Storm-0844’s prior Akira-related TTPs, and revisiting existing Akira indicators for potential overlap.
crime
FAQ2
What file extension does the Fog ransomware group use for encrypted files?
The Fog ransomware group uses the .flocked file extension for encrypted files.
Which threat actor operates and distributes the Fog ransomware?
The Fog ransomware is operated by Storm-0844, a group previously known for distributing Akira ransomware.
See also5
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.