Close Menu
  • Home
  • News
  • Security
  • Privacy
  • Cybercrime
    • Threat Groups
    • Ransomware
    • Explainers
    • Stealer Logs
  • AI
  • OSINT
  • Tools
    • Ransomtracker
    • Stealercheck
    • FortiBleed Checker
  • About Us
Facebook X (Twitter) Instagram Threads
Ransomnews
  • Home
  • News
  • Security
  • Privacy
  • Cybercrime
    • Threat Groups
    • Ransomware
    • Explainers
    • Stealer Logs
  • AI
  • OSINT
  • Tools
    • Ransomtracker
    • Stealercheck
    • FortiBleed Checker
  • About Us
Facebook X (Twitter) LinkedIn
Ransomnews

FOG · Threat actor profile

// THREAT ACTOR

FOG_

Dormant

FOG is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem — file encryption combined with the threat of stolen-data publication on a public leak site — and continues to post fresh victim claims as part of an ongoing extortion campaign.

For Ransomnews editorial coverage of FOG — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.

134 Victims tracked
0 / 6 Active mirrors
2024-07-16 First listing
2025-03-20 Most recent

Victims by year

  • 2025 45
  • 2024 89

Leak site mirrors

6 mirrors tracked, 0 currently reachable. These are criminal-infrastructure URLs — links are deliberately not provided.

  • xql562evsy7njcsngacphc2erzjfecwotdkobn3m4uxu2gtqh26newid.onion 500 Internal Server Error snapshot · 2025-06-05 15:11
  • xbkv2qey6u3gd3qxcojynrt4h5sgrhkar6whuo74wo63hijnn677jnyd.onion Blog snapshot · 2025-04-20 19:09
  • xbkv2qey6u3gd3qxcojynrt4h5sgrhkar6whuo74wo63hijnn677jnyd.onion Blog snapshot · 2025-04-20 19:05
  • hlbqbuy2bo3onn6h6eq7pbci24kughiaw4rkxrewidnqma3hwwgt2ead.onion 404: This page could not be found. snapshot · 2025-04-20 19:15
  • 44dz7r5uduhihaks7m62vztthp5s7thokbgeida7usm4rvakriuvk3yd.onion / snapshot · 2025-05-07 04:09
  • nw5zrjqarckmsf22rrgo5yooelpnn5raxhesuhrpzceqibmjwanbbaad.onion Google snapshot · 2025-05-07 03:08

Recent victims

The 50 most recent victims claimed by FOG. Total in the index: 134.

Date listed Victim Description
2025-03-20 Newtown Friends School (newtownfriends.org)
2025-03-17 RAE (Real Academia Española) (rae.es)
2025-03-13 University Diagnostic Medical Imaging, PC (udmi.net) 28.1 GB
2025-03-13 El Camino Real Academy (elcaminorealacademy) 111 GB
2025-03-11 Wilkinson Rogers (wilkinsonrogers.com) 57 GB
2025-03-11 Magnolia Manor (magnoliamanor.com) 54.6 GB
2025-03-06 Oberlin Cable Co-op (oberlin.net) 33 GB
2025-03-06 WJCC Public Schools (wjccschools.org) 27.7 GB
2025-03-05 The 19 biggest gitlabs
2025-03-05 SCOLARO FETTER GRIZANTI & McGOUGH, P.C. (scolaro.com) 92.5 GB
2025-03-04 Grupo Baston Aerossol (baston.com.br) 88.3 GB
2025-03-04 Pampili (pampili.com.br) 36.3 GB
2025-03-03 Central McGowan (centralmcgowan.com) 23.5 GB
2025-03-03 Klesk Metal Stamping Co (kleskmetalstamping.com) 2.2 GB
2025-02-26 Gitlabs: Synelixis Solutions, INGV, VMO Holdings
2025-02-23 Gitlabs: Naphix, WDNA, Bayteq
2025-02-19 Haggin Oaks Golf (hagginoaks.com) 29,2 GB
2025-02-19 Gitlabs: Next TI, VISEO, Hochschule Trier
2025-02-17 Greencastle-Antrim Senior High School (gcasd.org) 7.6 GB
2025-02-16 Gitlabs: Acqua development, QBurst, Pamyra.de
2025-02-13 Gitlabs: Omydoo, Ayomi, ADULLACT
2025-02-13 Mozo Grau (mozo-grau.com) 72.2
2025-02-12 The University of Notre Dame Australia (nd.edu.au) 62 GB
2025-02-12 Aurora Public Schools (aurorak12.org) 171 GB
2025-02-12 Saint George's College (saintgeorge.cl) 5 GB
2025-02-12 Hess (hess-gmbh.de) 6.5 GB
2025-02-12 Gitlabs: INGV, Spacemanic, Squeezer-software
2025-02-09 Gitlabs: Universitatea Politehnica din Bucuresti, Maxvy Technologies Pvt, iRidge Inc.
2025-02-07 Gitlabs: Chalmers tekniska högskola, Fligno, 3SS
2025-02-07 Gitlabs: eConceptions, Top Systems, DIEM
2025-02-04 Gitlabs: hemio.de, SOLEIL, Devlion
2025-02-03 Gitlabs: Bolin Centre for Climate Research, X-lab group, Madia
2025-02-03 Karadeniz Holding (karadenizholding.com) 1.5 TB
2025-02-01 Gitlabs: PT. ITPRENEUR INDONESIA TECHNOLOGY, GFZ Helmholtz Centre for Geosciences, LUA Cof
2025-01-31 Gitlabs: Professional Computer, X-Pans, Propulsion Academy AG
2025-01-30 Gitlabs: Prasaga, HE2B, Kombinat
2025-01-29 Boutin Jones (boutindentino.com) 180 GB
2025-01-24 ELTEK Group (eltekgroup.com) 13 GB
2025-01-24 De La Salle High School (dlshs.org) 20 GB
2025-01-23 Kooijman Vianen (kooijmanvianen.nl) 25.7 GB
2025-01-14 SciTech Services, Inc. 15 GB
2025-01-14 Buttery (butterycompany.com) 1.7 GB
2025-01-14 The University of Oklahoma (ou.edu) 91 MB
2025-01-11 OmniRide (omniride.com) 7.2 GB
2025-01-07 Saint-Bar (saintbar.be) 16.8 GB
2024-12-26 Ober Mountain (OberGatlinburg.com) 14.3 GB
2024-12-25 Aroma Housewares Co (Aromaco.com) 35 GB
2024-12-23 RODS Surveying (rods.cc) 43.5 GB
2024-12-23 Forum Architecture & Interior Design (forumarchitecture.com) 5.7 GB
2024-12-23 Gallade Chemical (galladechem.com) 2.4 GB

← Back to Ransomtracker

Statistics on this page are computed by Ransomnews from a live leak-site monitoring feed. Numbers update every ten minutes. Operator-written victim descriptions are truncated and shown in snippet form only. Source data: RansomLook (CC BY 4.0), aggregated and adapted by Ransomnews.

Facebook X (Twitter) LinkedIn
© 2026 Ransomnews.com

Type above and press Enter to search. Press Esc to cancel.

Cookies on Ransomnews

We use strictly-necessary cookies to run the site and may use first-party analytics to understand which articles are read. Some pages contain affiliate links — when you click one, the affiliate network sets cookies on the merchant's domain to attribute the referral. See the Cookie Policy and Affiliate Disclosure for detail.

RANSOMNEWS.COM

Tracking the criminal infrastructure of the internet.

Independent coverage of ransomware, breach economics, threat actors, privacy, AI security, and the open-source investigation toolkit.

// Topics

  • News
  • Security
  • Privacy
  • Cybercrime
  • AI
  • OSINT
  • Threat Groups
  • Stealer Logs
  • Ransomtracker
  • Stealercheck
  • FortiBleed Checker

// Site

  • About Us
  • Editorial Team
  • Contact
  • Tip Line
  • Editorial

// Legal

  • Privacy Policy
  • Terms of Service
  • Cookie Policy
  • Funding & Independence
  • RSS Feed
© 2026 Ransomnews.com · Tracking the criminal infrastructure of the internet.