Threat Intelligence Report December 17 - December 23 2024

Fog Ransomware Group

Fog Ransomware emerged in April 2024, targeting both Windows and Linux endpoints. It operates as a multi-pronged extortion operation, utilising a TOR-based Data Leak Site (DLS) to publicly list victims and host exfiltrated data from those who refuse to meet ransom demands.

This ransomware is part of the modern ransomware-as-a-service (RaaS) ecosystem, with customisable payloads tailored to disrupt operations in targeted environments.

Detailed TTPs

Initial Access and Foothold Establishment:

• Primary Initial Access Methods:
  • Exploitation of known vulnerabilities in public-facing systems.
  • Use of compromised credentials purchased from Initial Access Brokers (IABs).
• Post-Access Lateral Movement: Systematic traversal across network endpoints using valid credentials.

Cross-Platform Payloads:

• Windows Variant: Focuses on shadow copy deletion, service termination, and extensive configuration capabilities.
• Linux Variant: Targets virtual environments (e.g., VMSD and VMDK files) and employs tailored commands for environment disruption.

Fog Ransomware supports multiple command-line parameters. These include:

Parameter Description

File Encryption Behavior:

Windows Configuration: JSON-based configuration enabling:

• Custom encrypted file extensions.
• Ransom note filename configuration.
• Service and process termination lists.
• RSA public key embedding for encryption operations.

Readme.txt

Fog Data Leak Site (DLS):

First Observed: July 2024

Ransom Note:

• File Name: readme.txt
• Content: Instructions for victim communication via a TOR-based victim portal.

How to Mitigate Fog Ransomware

• Conduct regular cybersecurity awareness training.
• Educate staff on phishing attack identification and reporting suspicious activity.

• Enforce strong password policies.
• Enable Multi-Factor Authentication (MFA) for all remote and administrative access.

• Restrict RDP and SSH Access:
  • Use VPNs for secure access.
  • Enforce MFA on remote access portals.
• Implement network segmentation to prevent lateral movement.

• Regularly apply security patches and updates to operating systems, software, and firmware.
• Disable unnecessary services and protocols.

• Perform frequent, encrypted backups of critical systems and data.
• Store backups in offline, air-gapped environments.
• Regularly test data recovery processes.

• Deploy advanced endpoint detection and response (EDR) solutions.
• Enable real-time monitoring and alerting for suspicious activities.

• Enable network anomaly detection tools.
• Monitor log files for early indicators of compromise (IOCs).

Ransomware Victims Worldwide

A recent ransomware analysis reveals a striking 55.97% of global incidents targeted the United States, making it the hardest-hit country by far. Trailing behind, Canada experienced 5.66% of attacks, while Australia, France, Brazil, and India each reported 3.14%.

Other significantly affected countries include Germany at 2.52%, followed by the United Kingdom at 1.89%. Nations such as China, Italy, Poland, Sweden, and Indonesia each reported 1.26% of the total attacks.

Meanwhile, a diverse group of nations, including Mexico, Netherlands, Nigeria, Mongolia, Thailand, Israel, Saudi Arabia, Poland, Greece, Ukraine, Belgium, Ecuador, Sri Lanka, Hong Kong, Jamaica, Vietnam, Spain, Argentina, Egypt, and Botswana, each saw a limited impact, representing just 0.63% of the total incidents.

This analysis underscores the global and persistent nature of ransomware threats, with North America bearing the brunt of the attacks, followed by Europe and parts of Asia. These numbers emphasise the critical need for enhanced cybersecurity measures across all regions to combat the ever-evolving ransomware threat landscape.