fog
First seen July 16, 2024Active189 claimed victims
The claims below are reproduced as posted by fog on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Fog, which uses the .flocked extension for encrypted files, was first observed in May in campaigns by Storm-0844, a threat actor known for distributing Akira. By June, Storm-0844 was deploying Fog more than Akira.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Newtown Friends School (newtownfriends.org) | March 20, 2025 | ransomware_live | — |
| RAE (Real Academia Española) (rae.es) | March 17, 2025 | ransomware_live | — |
| University Diagnostic Medical Imaging, PC (udmi.net) | March 13, 2025 | ransomware_live | — |
| El Camino Real Academy (elcaminorealacademy) | March 12, 2025 | ransomware_live | — |
| Magnolia Manor (magnoliamanor.com) | March 10, 2025 | ransomware_live | — |
| Wilkinson Rogers (wilkinsonrogers.com) | March 10, 2025 | ransomware_live | — |
| Oberlin Cable Co-op (oberlin.net) | March 6, 2025 | ransomware_live | — |
| WJCC Public Schools (wjccschools.org) | March 6, 2025 | ransomware_live | — |
| SCOLARO FETTER GRIZANTI & McGOUGH, P.C. (scolaro.com) | March 5, 2025 | ransomware_live | — |
| The 19 biggest gitlabs | March 5, 2025 | ransomware_live | — |
| Melexis | March 5, 2025 | ransomware_live | — |
| Eumetsat | March 5, 2025 | ransomware_live | — |
| Blue Planet | March 5, 2025 | ransomware_live | — |
| Kotliva | March 5, 2025 | ransomware_live | — |
| Inelmatic | March 5, 2025 | ransomware_live | — |
| Euranova | March 5, 2025 | ransomware_live | — |
| InfoReach | March 5, 2025 | ransomware_live | — |
| Kr3m | March 5, 2025 | ransomware_live | — |
| Neopoly | March 5, 2025 | ransomware_live | — |
| Flightsim studio | March 5, 2025 | ransomware_live | — |
| Aeonsparx | March 5, 2025 | ransomware_live | — |
| FHNW | March 5, 2025 | ransomware_live | — |
| Engikam | March 5, 2025 | ransomware_live | — |
| Manning Publications Co. | March 5, 2025 | ransomware_live | — |
| Bizcode | March 5, 2025 | ransomware_live | — |
| 1X Internet | March 5, 2025 | ransomware_live | — |
| Grupo Baston Aerossol (baston.com.br) | March 4, 2025 | ransomware_live | — |
| Pampili (pampili.com.br) | March 4, 2025 | ransomware_live | — |
| Klesk Metal Stamping Co (kleskmetalstamping.com) | March 3, 2025 | ransomware_live | — |
| Central McGowan (centralmcgowan.com) | March 3, 2025 | ransomware_live | — |
| Gitlabs: Synelixis Solutions, INGV, VMO Holdings | February 26, 2025 | ransomware_live | — |
| Gitlabs: Naphix, WDNA, Bayteq | February 23, 2025 | ransomware_live | — |
| Naphix | February 23, 2025 | ransomware_live | — |
| WDNA | February 23, 2025 | ransomware_live | — |
| Bayteq | February 23, 2025 | ransomware_live | — |
| Gitlabs: Next TI, VISEO, Hochschule Trier | February 19, 2025 | ransomware_live | — |
| Haggin Oaks Golf (hagginoaks.com) | February 19, 2025 | ransomware_live | — |
| Next TI | February 19, 2025 | ransomware_live | — |
| VISEO | February 19, 2025 | ransomware_live | — |
| Greencastle-Antrim Senior High School (gcasd.org) | February 17, 2025 | ransomware_live | — |
| Gitlabs: Acqua development, QBurst, Pamyra.de | February 16, 2025 | ransomware_live | — |
| Acqua development | February 16, 2025 | ransomware_live | — |
| QBurst | February 16, 2025 | ransomware_live | — |
| Pamrya.de | February 16, 2025 | ransomware_live | — |
| Mozo Grau (mozo-grau.com) | February 13, 2025 | ransomware_live | — |
| Gitlabs: Omydoo, Ayomi, ADULLACT | February 13, 2025 | ransomware_live | — |
| Omydoo | February 13, 2025 | ransomware_live | — |
| Ayomi | February 13, 2025 | ransomware_live | — |
| ADULLACT | February 13, 2025 | ransomware_live | — |
| Hess (hess-gmbh.de) | February 12, 2025 | ransomware_live | — |
| Gitlabs: INGV, Spacemanic, Squeezer-software | February 12, 2025 | ransomware_live | — |
| INGV | February 12, 2025 | ransomware_live | — |
| Spacemanic | February 12, 2025 | ransomware_live | — |
| Squeezer-software | February 12, 2025 | ransomware_live | — |
| The University of Notre Dame Australia (nd.edu.au) | February 11, 2025 | ransomware_live | — |
| Aurora Public Schools (aurorak12.org) | February 11, 2025 | ransomware_live | — |
| Saint George's College (saintgeorge.cl) | February 11, 2025 | ransomware_live | — |
| Gitlabs: Universitatea Politehnica din Bucuresti, Maxvy Technologies Pvt, iRidge Inc. | February 9, 2025 | ransomware_live | — |
| Universitatea Politehnica din Bucuresti | February 9, 2025 | ransomware_live | — |
| Maxvy Technologies Pvt | February 9, 2025 | ransomware_live | — |
| iRidge Inc. | February 9, 2025 | ransomware_live | — |
| Gitlabs: Chalmers tekniska högskola, Fligno, 3SS | February 7, 2025 | ransomware_live | — |
| Chalmers tekniska högskola | February 7, 2025 | ransomware_live | — |
| Fligno | February 7, 2025 | ransomware_live | — |
| 3SS | February 7, 2025 | ransomware_live | — |
| Gitlabs: eConceptions, Top Systems, DIEM | February 6, 2025 | ransomware_live | — |
| eConceptions | February 6, 2025 | ransomware_live | — |
| Top Systems | February 6, 2025 | ransomware_live | — |
| DIEM | February 6, 2025 | ransomware_live | — |
| Gitlabs: hemio.de, SOLEIL, Devlion | February 4, 2025 | ransomware_live | — |
| hemio.de | February 4, 2025 | ransomware_live | — |
| SOLEIL | February 4, 2025 | ransomware_live | — |
| Devlion | February 4, 2025 | ransomware_live | — |
| Karadeniz Holding (karadenizholding.com) | February 3, 2025 | ransomware_live | — |
| Gitlabs: Bolin Centre for Climate Research, X-lab group, Madia | February 3, 2025 | ransomware_live | — |
| Bolin Centre for Climate Research | February 3, 2025 | ransomware_live | — |
| X-lab group | February 3, 2025 | ransomware_live | — |
| Madia | February 3, 2025 | ransomware_live | — |
| Gitlabs: PT. ITPRENEUR INDONESIA TECHNOLOGY, GFZ Helmholtz Centre for Geosciences, LUA Cof... | February 1, 2025 | ransomware_live | — |
| PT. ITPRENEUR INDONESIA TECHNOLOGY | February 1, 2025 | ransomware_live | — |
| GFZ Helmholtz Centre for Geosciences | February 1, 2025 | ransomware_live | — |
| LUA Coffee | February 1, 2025 | ransomware_live | — |
| CIE | February 1, 2025 | ransomware_live | — |
| Professional Computer Co., Ltd. | January 31, 2025 | ransomware_live | — |
| X-Pans | January 31, 2025 | ransomware_live | — |
| Propulsion Academy AG | January 31, 2025 | ransomware_live | — |
| Gitlabs: Professional Computer, X-Pans, Propulsion Academy AG | January 30, 2025 | ransomware_live | — |
| Prasaga | January 30, 2025 | ransomware_live | — |
| HE2B | January 30, 2025 | ransomware_live | — |
| Kombinat | January 30, 2025 | ransomware_live | — |
| Boutin Jones (boutindentino.com) | January 29, 2025 | ransomware_live | — |
| Gitlabs: Prasaga, HE2B, Kombinat | January 29, 2025 | ransomware_live | — |
| ELTEK Group (eltekgroup.com) | January 24, 2025 | ransomware_live | — |
| De La Salle High School (dlshs.org) | January 24, 2025 | ransomware_live | — |
| Kooijman Vianen (kooijmanvianen.nl) | January 23, 2025 | ransomware_live | — |
| Buttery (butterycompany.com) | January 14, 2025 | ransomware_live | — |
| SciTech Services, Inc. | January 14, 2025 | ransomware_live | — |
| The University of Oklahoma (ou.edu) | January 14, 2025 | ransomware_live | — |
| OmniRide (omniride.com) | January 10, 2025 | ransomware_live | — |
| Saint-Bar (saintbar.be) | January 7, 2025 | ransomware_live | — |
Page 1 of 2Older →
Claim data from ransomware.live and RansomLook (CC BY 4.0).