Navigating Through The Fog
April 28, 2025, 8:50 a.m.
Description
An open directory linked to a Fog ransomware affiliate was discovered, containing tools for reconnaissance, exploitation, lateral movement, and persistence. Initial access was gained through compromised SonicWall VPN credentials, while other tools facilitated credential theft and exploitation of Active Directory vulnerabilities. Persistence was maintained via AnyDesk, automated by a PowerShell script. Sliver C2 executables were used for command-and-control operations. The victims spanned multiple industries across Europe, North America, and South America, highlighting the affiliate's broad targeting scope. The toolkit included SonicWall Scanner, DonPAPI, Certipy, Zer0dump, and Pachine/noPac for various attack stages.
Tags
Date
- Created: April 28, 2025, 4:42 a.m.
- Published: April 28, 2025, 4:42 a.m.
- Modified: April 28, 2025, 8:50 a.m.
Attack Patterns
Additional Informations
- Retail
- Technology
- Transportation
- Education
- Greece
- Italy
- Brazil
- United States of America