Technology News and Headlines

Fog Ransomware Targets U.S. Organizations via Compromised VPN Credentials

Arctic Wolf Labs identified a new ransomware variant called Fog targeting U.S. organizations, primarily in education (80%) and recreation (20%) sectors. The attackers gained entry through compromised VPN credentials from two vendors and quickly escalated privileges using pass‑the‑hash, PsExec, and credential‑stuffing techniques. Fog encrypts files with .FOG or .FLOCKED extensions, disables Windows Defender, deletes shadow copies, and leaves ransom notes that point to a .onion site. The group’s structure remains opaque, but its code reuse suggests a shared development source.