THREAT ACTOR
FOG_
DormantFOG is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of FOG, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
Victims by year
- 2025 45
- 2024 89
Leak site mirrors
6 mirrors tracked, 0 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
xql562evsy7njcsngacphc2erzjfecwotdkobn3m4uxu2gtqh26newid.onion500 Internal Server Error snapshot · 2025-06-05 15:11 -
xbkv2qey6u3gd3qxcojynrt4h5sgrhkar6whuo74wo63hijnn677jnyd.onionBlog snapshot · 2025-04-20 19:09 -
xbkv2qey6u3gd3qxcojynrt4h5sgrhkar6whuo74wo63hijnn677jnyd.onionBlog snapshot · 2025-04-20 19:05 -
hlbqbuy2bo3onn6h6eq7pbci24kughiaw4rkxrewidnqma3hwwgt2ead.onion404: This page could not be found. snapshot · 2025-04-20 19:15 -
44dz7r5uduhihaks7m62vztthp5s7thokbgeida7usm4rvakriuvk3yd.onion/ snapshot · 2025-05-07 04:09 -
nw5zrjqarckmsf22rrgo5yooelpnn5raxhesuhrpzceqibmjwanbbaad.onionGoogle snapshot · 2025-05-07 03:08
Recent victims
The 50 most recent victims claimed by FOG. Total in the index: 134.
| Date listed | Victim | Description |
|---|---|---|
| 2025-03-20 | Newtown Friends School (newtownfriends.org) | |
| 2025-03-17 | RAE (Real Academia Española) (rae.es) | |
| 2025-03-13 | University Diagnostic Medical Imaging, PC (udmi.net) | 28.1 GB |
| 2025-03-13 | El Camino Real Academy (elcaminorealacademy) | 111 GB |
| 2025-03-11 | Wilkinson Rogers (wilkinsonrogers.com) | 57 GB |
| 2025-03-11 | Magnolia Manor (magnoliamanor.com) | 54.6 GB |
| 2025-03-06 | Oberlin Cable Co-op (oberlin.net) | 33 GB |
| 2025-03-06 | WJCC Public Schools (wjccschools.org) | 27.7 GB |
| 2025-03-05 | The 19 biggest gitlabs | |
| 2025-03-05 | SCOLARO FETTER GRIZANTI & McGOUGH, P.C. (scolaro.com) | 92.5 GB |
| 2025-03-04 | Grupo Baston Aerossol (baston.com.br) | 88.3 GB |
| 2025-03-04 | Pampili (pampili.com.br) | 36.3 GB |
| 2025-03-03 | Central McGowan (centralmcgowan.com) | 23.5 GB |
| 2025-03-03 | Klesk Metal Stamping Co (kleskmetalstamping.com) | 2.2 GB |
| 2025-02-26 | Gitlabs: Synelixis Solutions, INGV, VMO Holdings | |
| 2025-02-23 | Gitlabs: Naphix, WDNA, Bayteq | |
| 2025-02-19 | Haggin Oaks Golf (hagginoaks.com) | 29,2 GB |
| 2025-02-19 | Gitlabs: Next TI, VISEO, Hochschule Trier | |
| 2025-02-17 | Greencastle-Antrim Senior High School (gcasd.org) | 7.6 GB |
| 2025-02-16 | Gitlabs: Acqua development, QBurst, Pamyra.de | |
| 2025-02-13 | Gitlabs: Omydoo, Ayomi, ADULLACT | |
| 2025-02-13 | Mozo Grau (mozo-grau.com) | 72.2 |
| 2025-02-12 | The University of Notre Dame Australia (nd.edu.au) | 62 GB |
| 2025-02-12 | Aurora Public Schools (aurorak12.org) | 171 GB |
| 2025-02-12 | Saint George's College (saintgeorge.cl) | 5 GB |
| 2025-02-12 | Hess (hess-gmbh.de) | 6.5 GB |
| 2025-02-12 | Gitlabs: INGV, Spacemanic, Squeezer-software | |
| 2025-02-09 | Gitlabs: Universitatea Politehnica din Bucuresti, Maxvy Technologies Pvt, iRidge Inc. | |
| 2025-02-07 | Gitlabs: Chalmers tekniska högskola, Fligno, 3SS | |
| 2025-02-07 | Gitlabs: eConceptions, Top Systems, DIEM | |
| 2025-02-04 | Gitlabs: hemio.de, SOLEIL, Devlion | |
| 2025-02-03 | Gitlabs: Bolin Centre for Climate Research, X-lab group, Madia | |
| 2025-02-03 | Karadeniz Holding (karadenizholding.com) | 1.5 TB |
| 2025-02-01 | Gitlabs: PT. ITPRENEUR INDONESIA TECHNOLOGY, GFZ Helmholtz Centre for Geosciences, LUA Cof | |
| 2025-01-31 | Gitlabs: Professional Computer, X-Pans, Propulsion Academy AG | |
| 2025-01-30 | Gitlabs: Prasaga, HE2B, Kombinat | |
| 2025-01-29 | Boutin Jones (boutindentino.com) | 180 GB |
| 2025-01-24 | ELTEK Group (eltekgroup.com) | 13 GB |
| 2025-01-24 | De La Salle High School (dlshs.org) | 20 GB |
| 2025-01-23 | Kooijman Vianen (kooijmanvianen.nl) | 25.7 GB |
| 2025-01-14 | SciTech Services, Inc. | 15 GB |
| 2025-01-14 | Buttery (butterycompany.com) | 1.7 GB |
| 2025-01-14 | The University of Oklahoma (ou.edu) | 91 MB |
| 2025-01-11 | OmniRide (omniride.com) | 7.2 GB |
| 2025-01-07 | Saint-Bar (saintbar.be) | 16.8 GB |
| 2024-12-26 | Ober Mountain (OberGatlinburg.com) | 14.3 GB |
| 2024-12-25 | Aroma Housewares Co (Aromaco.com) | 35 GB |
| 2024-12-23 | RODS Surveying (rods.cc) | 43.5 GB |
| 2024-12-23 | Forum Architecture & Interior Design (forumarchitecture.com) | 5.7 GB |
| 2024-12-23 | Gallade Chemical (galladechem.com) | 2.4 GB |
CONFIRMED ATTACKS
Fog confirmed attacks: 29 verified incidents
Ransomnews has verified 29 Fog incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from June 2024 to March 2025. United States accounts for 19 of them (66%), with victims recorded in 10 countries in total. The most affected sector is education, at 12 confirmed victims. A ransom payment was publicly confirmed in 0 cases and publicly refused in 1; the outcome is unrecorded in the remaining 28. Where a figure was disclosed (10 cases), these incidents account for 316,831 exposed records.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Fog incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| March 2025 | University of Applied Sciences and Arts Northwestern FHNW | Education | Windisch, Switzerland | — | Unknown | Source |
| February 2025 | Magnolia Manor | Healthcare | Georgia, United States | 960 | Unknown | Source |
| February 2025 | Real Academia Española | Education | Madrid, Spain | — | Unknown | Source |
| February 2025 | Williamsburg-James City County Schools | Education | Virginia, United States | — | Unknown | Source |
| February 2025 | Saint George's College | Education | Vitacura, Chile | — | Unknown | Source |
| January 2025 | The University of Notre Dame Australia | Education | Fremantle, Australia | — | Unknown | Source |
| January 2025 | Aurora Public Schools | Education | Colorado, United States | — | Unknown | Source |
| January 2025 | ELTEK Group | Manufacturing | Casale Monferrato, Italy | — | Unknown | Source |
| January 2025 | University of Oklahoma | Education | Oklahoma, United States | — | Unknown | Source |
| December 2024 | Potomac & Rappahannock Transportation Commission (OmniRide) | Government | Virginia, United States | — | Unknown | Source |
| December 2024 | Karadeniz Holding | Utilities | Istanbul, Turkey | — | Unknown | Source |
| December 2024 | Waverley Christian College | Education | Wantirna South, Australia | — | Unknown | Source |
| November 2024 | WPM Pathology Laboratory | Healthcare | Kansas, United States | 5,694 | Unknown | Source |
| November 2024 | University Diagnostic Medical Imaging, PC | Healthcare | New York, United States | 138,080 | Unknown | Source |
| October 2024 | Energy Capital Credit Union | Finance | Texas, United States | 49,695 | Unknown | Source |
| October 2024 | SciTech Services, Inc. | Service | Maryland, United States | 182 | Unknown | Source |
| October 2024 | Boutin Jones Inc. | Legal | California, United States | — | Unknown | Source |
| October 2024 | Schweiger GmbH | Manufacturing | Sauerlach, Germany | — | Unknown | Source |
| September 2024 | Clear Connection, Inc. | Utilities | Maryland, United States | 41 | Unknown | Source |
| August 2024 | Mar-Bal, Inc. | Manufacturing | Ohio, United States | — | Unknown | Source |
| August 2024 | Prentke Romich Company dba PRC-Saltillo | Healthcare | Ohio, United States | 51,627 | Unknown | Source |
| July 2024 | Philadelphia Macaroni Company | Food and Beverage | Pennsylvania, United States | 6,115 | Unknown | Source |
| July 2024 | Governo Federal do Brasil | Government | Brasília, Brazil | — | Unknown | Source |
| July 2024 | Cucamonga Valley Water District | Government | California, United States | — | No | Source |
| July 2024 | City of Cold Lake | Government | Cold Lake, Canada | — | Unknown | Source |
| July 2024 | Goshen Central School District | Education | New York, United States | — | Unknown | Source |
| June 2024 | Alvin Independent School District | Education | Texas, United States | 48,877 | Unknown | Source |
| June 2024 | West Allis-West Milwaukee School District | Education | Wisconsin, United States | — | Unknown | Source |
| June 2024 | Asbury Theological Seminary | Education | Kentucky, United States | 15,560 | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Fog's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.