Fog Ransomware Attacking US Organizations Leveraging Compromised VPN Credentials

Cybersecurity: Fog Ransomware Targeting US Organizations with Compromised VPN Credentials

A newly identified ransomware variant, known as Fog, has become a major threat to educational and recreational organizations in the United States.

Beginning in May 2024, Arctic Wolf Labs has monitored its deployment across multiple incidents, with 80% of affected entities in the education sector and 20% in recreation.

The ransomware activity has been consistent, displaying similar attack patterns and procedures across various cases. All incidents have been confined to the United States, indicating a geographically concentrated campaign.

Fog ransomware functions as a variant rather than a distinct entity, underscoring the separation between software developers and those executing attacks. This distinction is crucial as ransomware groups often appear as unified entities but consist of multiple independent affiliate teams. Coordination among threat actors has been suggested, although the organizational structure behind Fog remains unclear.

The last documented attack occurred on May 23, 2024, marking a timeline for implementing defensive measures. Arctic Wolf analysts identified the malware after beginning investigations in early May.

Investigations revealed that threat actors gained access to victim environments using compromised VPN credentials, exploiting vulnerabilities in remote access security. Two separate VPN gateway vendors were involved in these breaches.

Attack Methodology and Infection Mechanisms

Upon network infiltration, attackers employed a multi-stage approach, utilizing common penetration testing tactics alongside ransomware deployment.

Pass-the-hash attacks targeted administrator accounts to establish RDP connections to Windows Servers running Hyper-V and Veeam backup systems. Credential stuffing facilitated lateral movement within the environment.

PsExec was used across multiple hosts, and RDP and SMB protocols provided access to systems. Windows Defender was disabled on affected servers before encryption, removing a key defense layer.

The ransomware payload shares techniques with other variants, with identical code blocks across cases. Upon execution, a file named DbgLog.sys is created in the %AppData% directory to log activity status. System information is gathered using NTDLL.DLL and NtQuerySystemInformation functions for thread allocation.

Command line options include NOMUTEX for concurrent execution, TARGET for specific discovery locations, and CONSOLE for output display. A JSON configuration block manages encryption, including the RSA public key, file extensions (.FOG or .FLOCKED), ransom note names, and service shutdown procedures.

File discovery utilizes standard Windows APIs, employing Unicode variants. The encryption process uses a thread pool scaled to system processors, implementing CryptImportKey and CryptEncrypt functions before renaming files and writing ransom notes.

vssadmin.exe executes with delete shadows /all /quiet commands, removing volume shadow copies to eliminate backup recovery options.

Tool Name Description

PsExec Enables execution of processes on other systems with full interactivity for console applications, used for lateral movement and command execution

Metasploit Penetration testing framework used against Veeam servers during reconnaissance

SoftPerfect Network Scanner Network administration tool used to discover network services across environments

Advanced Port Scanner Free network and port scanning utility deployed to identify accessible network services

SharpShares v2.3 Open-source tool used to enumerate and discover accessible network shares

Veeam-Get-Creds.ps1 PowerShell script designed to extract passwords from Veeam Backup and Replication Credentials Manager

Organizations are advised to secure VPN infrastructure, implement multi-factor authentication, maintain secure off-site backup systems, and deploy defense-in-depth strategies. The threat actors showed financial motivation with rapid encryption timelines and no data exfiltration, indicating a focus on quick payouts rather than complex extortion schemes.

Based on reporting by Cyber Security News.