Close Menu
  • Home
  • News
  • Security
  • Privacy
  • Cybercrime
    • Threat Groups
    • Ransomware
    • Explainers
    • Stealer Logs
  • AI
  • OSINT
  • Tools
    • Ransomtracker
    • Stealercheck
    • FortiBleed Checker
    • Site Check
  • Data
    • Ransomware statistics
    • Ransom payment rate
    • Breach verification
  • Newsletter
  • About Us
Facebook X (Twitter) Instagram Threads
Ransomnews
  • Home
  • News
  • Security
  • Privacy
  • Cybercrime
    • Threat Groups
    • Ransomware
    • Explainers
    • Stealer Logs
  • AI
  • OSINT
  • Tools
    • Ransomtracker
    • Stealercheck
    • FortiBleed Checker
    • Site Check
  • Data
    • Ransomware statistics
    • Ransom payment rate
    • Breach verification
  • Newsletter
  • About Us
Facebook X (Twitter) LinkedIn
Ransomnews

FOG · Threat actor profile

THREAT ACTOR

FOG_

Dormant

FOG is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.

For Ransomnews editorial coverage of FOG, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.

134 Victims tracked
0 / 6 Active mirrors
2024-07-16 First listing
2025-03-20 Most recent

Victims by year

  • 2025 45
  • 2024 89

Leak site mirrors

6 mirrors tracked, 0 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.

  • xql562evsy7njcsngacphc2erzjfecwotdkobn3m4uxu2gtqh26newid.onion 500 Internal Server Error snapshot · 2025-06-05 15:11
  • xbkv2qey6u3gd3qxcojynrt4h5sgrhkar6whuo74wo63hijnn677jnyd.onion Blog snapshot · 2025-04-20 19:09
  • xbkv2qey6u3gd3qxcojynrt4h5sgrhkar6whuo74wo63hijnn677jnyd.onion Blog snapshot · 2025-04-20 19:05
  • hlbqbuy2bo3onn6h6eq7pbci24kughiaw4rkxrewidnqma3hwwgt2ead.onion 404: This page could not be found. snapshot · 2025-04-20 19:15
  • 44dz7r5uduhihaks7m62vztthp5s7thokbgeida7usm4rvakriuvk3yd.onion / snapshot · 2025-05-07 04:09
  • nw5zrjqarckmsf22rrgo5yooelpnn5raxhesuhrpzceqibmjwanbbaad.onion Google snapshot · 2025-05-07 03:08

Recent victims

The 50 most recent victims claimed by FOG. Total in the index: 134.

Date listed Victim Description
2025-03-20 Newtown Friends School (newtownfriends.org)
2025-03-17 RAE (Real Academia Española) (rae.es)
2025-03-13 University Diagnostic Medical Imaging, PC (udmi.net) 28.1 GB
2025-03-13 El Camino Real Academy (elcaminorealacademy) 111 GB
2025-03-11 Wilkinson Rogers (wilkinsonrogers.com) 57 GB
2025-03-11 Magnolia Manor (magnoliamanor.com) 54.6 GB
2025-03-06 Oberlin Cable Co-op (oberlin.net) 33 GB
2025-03-06 WJCC Public Schools (wjccschools.org) 27.7 GB
2025-03-05 The 19 biggest gitlabs
2025-03-05 SCOLARO FETTER GRIZANTI & McGOUGH, P.C. (scolaro.com) 92.5 GB
2025-03-04 Grupo Baston Aerossol (baston.com.br) 88.3 GB
2025-03-04 Pampili (pampili.com.br) 36.3 GB
2025-03-03 Central McGowan (centralmcgowan.com) 23.5 GB
2025-03-03 Klesk Metal Stamping Co (kleskmetalstamping.com) 2.2 GB
2025-02-26 Gitlabs: Synelixis Solutions, INGV, VMO Holdings
2025-02-23 Gitlabs: Naphix, WDNA, Bayteq
2025-02-19 Haggin Oaks Golf (hagginoaks.com) 29,2 GB
2025-02-19 Gitlabs: Next TI, VISEO, Hochschule Trier
2025-02-17 Greencastle-Antrim Senior High School (gcasd.org) 7.6 GB
2025-02-16 Gitlabs: Acqua development, QBurst, Pamyra.de
2025-02-13 Gitlabs: Omydoo, Ayomi, ADULLACT
2025-02-13 Mozo Grau (mozo-grau.com) 72.2
2025-02-12 The University of Notre Dame Australia (nd.edu.au) 62 GB
2025-02-12 Aurora Public Schools (aurorak12.org) 171 GB
2025-02-12 Saint George's College (saintgeorge.cl) 5 GB
2025-02-12 Hess (hess-gmbh.de) 6.5 GB
2025-02-12 Gitlabs: INGV, Spacemanic, Squeezer-software
2025-02-09 Gitlabs: Universitatea Politehnica din Bucuresti, Maxvy Technologies Pvt, iRidge Inc.
2025-02-07 Gitlabs: Chalmers tekniska högskola, Fligno, 3SS
2025-02-07 Gitlabs: eConceptions, Top Systems, DIEM
2025-02-04 Gitlabs: hemio.de, SOLEIL, Devlion
2025-02-03 Gitlabs: Bolin Centre for Climate Research, X-lab group, Madia
2025-02-03 Karadeniz Holding (karadenizholding.com) 1.5 TB
2025-02-01 Gitlabs: PT. ITPRENEUR INDONESIA TECHNOLOGY, GFZ Helmholtz Centre for Geosciences, LUA Cof
2025-01-31 Gitlabs: Professional Computer, X-Pans, Propulsion Academy AG
2025-01-30 Gitlabs: Prasaga, HE2B, Kombinat
2025-01-29 Boutin Jones (boutindentino.com) 180 GB
2025-01-24 ELTEK Group (eltekgroup.com) 13 GB
2025-01-24 De La Salle High School (dlshs.org) 20 GB
2025-01-23 Kooijman Vianen (kooijmanvianen.nl) 25.7 GB
2025-01-14 SciTech Services, Inc. 15 GB
2025-01-14 Buttery (butterycompany.com) 1.7 GB
2025-01-14 The University of Oklahoma (ou.edu) 91 MB
2025-01-11 OmniRide (omniride.com) 7.2 GB
2025-01-07 Saint-Bar (saintbar.be) 16.8 GB
2024-12-26 Ober Mountain (OberGatlinburg.com) 14.3 GB
2024-12-25 Aroma Housewares Co (Aromaco.com) 35 GB
2024-12-23 RODS Surveying (rods.cc) 43.5 GB
2024-12-23 Forum Architecture & Interior Design (forumarchitecture.com) 5.7 GB
2024-12-23 Gallade Chemical (galladechem.com) 2.4 GB

CONFIRMED ATTACKS

Fog confirmed attacks: 29 verified incidents

Ransomnews has verified 29 Fog incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from June 2024 to March 2025. United States accounts for 19 of them (66%), with victims recorded in 10 countries in total. The most affected sector is education, at 12 confirmed victims. A ransom payment was publicly confirmed in 0 cases and publicly refused in 1; the outcome is unrecorded in the remaining 28. Where a figure was disclosed (10 cases), these incidents account for 316,831 exposed records.

29Verified incidents
10Countries
2024–2025Active range
0%Paid, where outcome known

Confirmed victims by year

  • 202420
  • 20259

Most affected sectors

  • Education12
  • Healthcare4
  • Government4
  • Manufacturing3
  • Utilities2
  • Service1
  • Legal1
  • Food and Beverage1

Most affected countries

  • United States19
  • Australia2
  • Canada1
  • Spain1
  • Turkey1
  • Brazil1
  • Switzerland1
  • Italy1

Verified Fog incidents

DateOrganisationSector LocationRecordsRansom paidSource
March 2025 University of Applied Sciences and Arts Northwestern FHNW Education Windisch, Switzerland — Unknown Source
February 2025 Magnolia Manor Healthcare Georgia, United States 960 Unknown Source
February 2025 Real Academia Española Education Madrid, Spain — Unknown Source
February 2025 Williamsburg-James City County Schools Education Virginia, United States — Unknown Source
February 2025 Saint George's College Education Vitacura, Chile — Unknown Source
January 2025 The University of Notre Dame Australia Education Fremantle, Australia — Unknown Source
January 2025 Aurora Public Schools Education Colorado, United States — Unknown Source
January 2025 ELTEK Group Manufacturing Casale Monferrato, Italy — Unknown Source
January 2025 University of Oklahoma Education Oklahoma, United States — Unknown Source
December 2024 Potomac & Rappahannock Transportation Commission (OmniRide) Government Virginia, United States — Unknown Source
December 2024 Karadeniz Holding Utilities Istanbul, Turkey — Unknown Source
December 2024 Waverley Christian College Education Wantirna South, Australia — Unknown Source
November 2024 WPM Pathology Laboratory Healthcare Kansas, United States 5,694 Unknown Source
November 2024 University Diagnostic Medical Imaging, PC Healthcare New York, United States 138,080 Unknown Source
October 2024 Energy Capital Credit Union Finance Texas, United States 49,695 Unknown Source
October 2024 SciTech Services, Inc. Service Maryland, United States 182 Unknown Source
October 2024 Boutin Jones Inc. Legal California, United States — Unknown Source
October 2024 Schweiger GmbH Manufacturing Sauerlach, Germany — Unknown Source
September 2024 Clear Connection, Inc. Utilities Maryland, United States 41 Unknown Source
August 2024 Mar-Bal, Inc. Manufacturing Ohio, United States — Unknown Source
August 2024 Prentke Romich Company dba PRC-Saltillo Healthcare Ohio, United States 51,627 Unknown Source
July 2024 Philadelphia Macaroni Company Food and Beverage Pennsylvania, United States 6,115 Unknown Source
July 2024 Governo Federal do Brasil Government Brasília, Brazil — Unknown Source
July 2024 Cucamonga Valley Water District Government California, United States — No Source
July 2024 City of Cold Lake Government Cold Lake, Canada — Unknown Source
July 2024 Goshen Central School District Education New York, United States — Unknown Source
June 2024 Alvin Independent School District Education Texas, United States 48,877 Unknown Source
June 2024 West Allis-West Milwaukee School District Education Wisconsin, United States — Unknown Source
June 2024 Asbury Theological Seminary Education Kentucky, United States 15,560 Unknown Source

Claimed vs confirmed. The figures above the fold on this page come from Fog's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.

← Back to Ransomtracker

Statistics on this page are computed by Ransomnews from a live leak-site monitoring feed. Numbers update every ten minutes. Operator-written victim descriptions are truncated and shown in snippet form only. Source data: RansomLook (CC BY 4.0), aggregated and adapted by Ransomnews.

The Ransomnews Monthly

What leaked, what held up

One email a month: the datasets we verified, and the ones that fell apart under scrutiny.

Double opt-in. We store your email, signup time, and IP for consent records (GDPR Art. 7). See our privacy policy.

Free tool

How does your own site score?

Forty passive checks on TLS, security headers, email spoofing and privacy. A grade out of 100 in about fifteen seconds.

No signup. Nothing installed. We only request what your site already serves publicly.

Free tool

Were you in a leak?

Check whether an email address has surfaced in infostealer logs. No signup, no data stored.

Run StealerCheck

Live data

Ransomtracker

Victims as they are posted to ransomware leak sites, tracked continuously and checked against the claims.

Open the tracker

9,613 confirmed attacks tracked

Facebook X (Twitter) LinkedIn
© 2026 Ransomnews.com

Type above and press Enter to search. Press Esc to cancel.

Cookies on Ransomnews

We use strictly-necessary cookies to run the site and may use first-party analytics to understand which articles are read. Some pages contain affiliate links; when you click one, the affiliate network sets cookies on the merchant's domain to attribute the referral. See the Cookie Policy and Affiliate Disclosure for detail.

RANSOMNEWS.COM

Tracking the criminal infrastructure of the internet.

Independent coverage of ransomware, breach economics, threat actors, privacy, AI security, and the open-source investigation toolkit.

Topics

  • News
  • Security
  • Privacy
  • Cybercrime
  • AI
  • OSINT
  • Threat Groups
  • Stealer Logs
  • Ransomtracker
  • Stealercheck
  • FortiBleed Checker
  • Site Check

Site

  • About Us
  • Editorial Team
  • Contact
  • Tip Line
  • Editorial

Legal

  • Privacy Policy
  • Terms of Service
  • Cookie Policy
  • Funding & Independence
  • RSS Feed
© 2026 Ransomnews.com · Tracking the criminal infrastructure of the internet.