FOG Threat Actor Dossier

The FOG threat actor group, first identified by Arctic Wolf researchers on May 2, 2024, represents a distinctive strain within the larger ecosystem of ransomware operations. While sharing similarities with other ransomware groups, FOG’s tactics, techniques, and procedures (TTPs) emphasize speed and efficiency over the more complex, multi-stage attacks observed in other contemporary ransomware operations.

This dossier provides a comprehensive analysis of FOG’s attack patterns, operational methodologies, and the broader implications of its activities in the cybersecurity landscape.

Attack Lifecycle

Initial Access:

FOG utilizes stolen credentials to gain unauthorized access to networks, particularly through Virtual Private Network (VPN) gateways. As of the latest reports, the group has exploited two different VPN vendors, though the specifics remain undisclosed. This method aligns with an observed trend of targeting remote access services to penetrate secure environments.

Privilege Escalation:

Upon gaining initial access, FOG performs pass-the-hash attacks, leveraging administrative credentials to establish Remote Desktop Protocol (RDP) connections to Windows servers, particularly those running virtualization environments such as Hyper-V. Additionally, credential stuffing is employed to hijack high-value accounts, facilitating lateral movement across the network.

Lateral Movement:

For further propagation within the compromised network, FOG deploys the PsExec utility across multiple hosts, streamlining the execution of remote commands. This approach enables rapid encryption of targeted systems, effectively shutting down critical infrastructure with minimal delay.

Data Encryption:

• Target: Virtual Machine Disk Files (VMDK)
• File Extension: .FOG, .FLOCKED (Configurable)

FOG’s primary focus is the encryption of VMDK files within virtual machine storage, a critical asset for many organizations relying on virtualized environments. By appending the “.FOG” or “.FLOCKED” extension to encrypted files, FOG customizes the ransomware to increase its psychological impact on the victims. The specific extension used can be configured by the operator through a JSON-based configuration block, suggesting a modular and adaptable malware framework.

Defense Evasion:

FOG takes extensive measures to thwart recovery efforts by deleting backups stored in object storage systems, such as Veeam, and erasing Windows Volume Shadow Copies. These actions severely diminish the likelihood of successful data restoration without paying the ransom.

Unique Characteristics

Contrary to the growing trend of double and triple extortion tactics, FOG does not engage in data exfiltration or operate a leak site. This omission suggests a focus on rapid financial gain through ransomware payments, rather than leveraging stolen data for further extortion or sale on dark web marketplaces. The absence of data exfiltration may also indicate a prioritization of operational speed and simplicity over the increased complexity and risk associated with handling sensitive exfiltrated data.

The ransom note left by FOG, named “HELP_YOUR_FILES.HTML,” typically demands substantial payments in cryptocurrency in exchange for decryption tools. However, payment does not guarantee successful file recovery, as is common with many ransomware operations. The group’s choice of email contact ([email protected]) reflects a preference for anonymity and the use of temporary, disposable communication channels.

Mitigation Strategies

Given the nature of FOG’s attack methodologies, organizations are advised to implement the following countermeasures:

• Enhance VPN Security: Regularly update and patch VPN gateways to address known vulnerabilities. Implement multi-factor authentication (MFA) for VPN access to reduce the risk of credential compromise.
• Monitor Privileged Accounts: Deploy monitoring tools to detect unusual activities associated with administrative accounts, such as abnormal login times or access patterns indicative of pass-the-hash attacks.
• Regular Backups: Adopt a 3-2-1 backup strategy, ensuring backups are stored both offsite and in immutable storage systems that cannot be easily tampered with by ransomware.
• Endpoint Detection and Response (EDR): Utilize EDR solutions capable of identifying and responding to lateral movement attempts, particularly those involving tools like PsExec.
• Incident Response Plan: Develop and maintain a comprehensive incident response plan, including protocols for isolating affected systems, containing the spread of ransomware, and restoring operations using unaffected backups.

Targeted Sectors: Focus on U.S. Education Sector

FOG has predominantly targeted the U.S. education sector, focusing on large academic institutions and school districts. These entities are attractive targets for several reasons:

Educational institutions store a vast amount of sensitive data, including personal information of students and staff, financial records, research data, and intellectual property. This data is crucial for the operations of these institutions, making them more likely to pay a ransom to regain access.

Many educational institutions, particularly public schools, often operate with limited cybersecurity budgets and under-resourced IT departments. This makes them more vulnerable to attacks and less able to defend against sophisticated threat actors like FOG.

The disruption of digital infrastructure in educational institutions can have severe consequences, such as halting online classes, disrupting administrative functions, and delaying academic research. This urgency increases the pressure on victims to pay the ransom quickly to restore normal operations.

Decryption and Recovery

As of the latest intelligence, there are no known public decryption methods or tools available for FOG ransomware. The encryption used by FOG is robust, and researchers have not yet identified any vulnerabilities or flaws in the encryption process that could be exploited to create a free decryptor.

Key Points Regarding Decryption

• No Known Decryptor: Currently, there are no decryptors available for files encrypted by FOG ransomware. Victims are left with few options other than restoring from backups or paying the ransom, though paying does not guarantee the restoration of files.
• Variants of STOP/DJVU: Since FOG is a variant of the STOP/DJVU ransomware family, it’s important to note that while some older variants of STOP/DJVU have had decryptors released, FOG represents a newer, more sophisticated iteration. The encryption techniques have likely been enhanced to prevent the effectiveness of existing decryptors.
• Backup Restoration: Given the lack of a decryptor, the most effective recovery method remains restoring data from secure, unaffected backups. Organizations are strongly advised to maintain regular backups and store them in locations that cannot be easily accessed or deleted by ransomware, such as offline or cloud-based immutable storage.

Recommendations for Victims

• Avoid Paying the Ransom: Payment does not guarantee the return of encrypted data and may encourage further criminal activity. Additionally, paying the ransom does not eliminate the possibility of residual malware or backdoors left in the compromised network.
• Consult with Cybersecurity Experts: Victims should consult with cybersecurity professionals to assess the extent of the attack, ensure thorough removal of the ransomware, and restore systems securely.
• Strengthen Backup Strategies: Implement and regularly update comprehensive backup strategies, including the 3-2-1 backup rule, to minimize the impact of future ransomware attacks.

By understanding the sectors FOG targets and the current limitations in decryption, organizations can better prepare for and respond to potential ransomware threats, ensuring stronger defenses and more effective recovery options.

Conclusion

The FOG threat actor group represents a streamlined, financially motivated ransomware operation that deviates from the more elaborate extortion methods seen in other groups. Its reliance on compromised VPN credentials and rapid encryption of virtualized environments underscores the importance of robust cybersecurity defenses, particularly in sectors such as education, which FOG has notably targeted. As the group evolves, continuous monitoring and proactive security measures will be critical to defending against future attacks.

Cybersecurity teams must remain vigilant and adopt layered security strategies to mitigate the risks posed by emerging threats like FOG, ensuring that organizations are well-prepared to respond to and recover from potential ransomware incidents.