UNUSUAL TOOLSET USED IN RECENT FOG RANSOMWARE ATTACK

Summary from the TLDR InfoSec newsletter

Fog ransomware operators attacked an Asian financial firm in May using Syteca monitoring and pentesting tools GC2, Adaptix, and Stowaway. They stayed in the network for two weeks before deploying ransomware. The attackers maintained persistence post-attack and utilized tools often linked to espionage, suggesting intelligence-gathering motives with ransomware as a secondary goal. Since May 2024, Fog ransomware has evolved from targeting US schools through compromised VPNs to exploiting Veeam vulnerabilities and shifted to email infections featuring provocative ransom notes mocking Elon Musk's DOGE agency.