Fog
Ransomware Group Profile
Overview
Fog, which uses the .flocked extension for encrypted files, was first observed in May in campaigns by Storm-0844, a threat actor known for distributing Akira. By June, Storm-0844 was deploying Fog more than Akira.
Dark Web Infrastructure (5)
xql562evsy7njcsngacphc2erzjfecwotdkobn3m4uxu2gtqh26newid.onion
xbkv2qey6u3gd3qxcojynrt4h5sgrhkar6whuo74wo63hijnn677jnyd.onion
hlbqbuy2bo3onn6h6eq7pbci24kughiaw4rkxrewidnqma3hwwgt2ead.onion
44dz7r5uduhihaks7m62vztthp5s7thokbgeida7usm4rvakriuvk3yd.onion
nw5zrjqarckmsf22rrgo5yooelpnn5raxhesuhrpzceqibmjwanbbaad.onion
Associated Threat Actors (1)
Activity Timeline
First Seen2025
Last Seen2025
Leak Sites5
Quick Actions