{
  "name": "FOG Ransomware Spread by Cybercriminals Claiming Ties to DOGE",
  "slug": "fog-ransomware-spread-by-cybercriminals-claiming-ties-to-doge",
  "description": "An investigation of nine malware samples revealed FOG ransomware being distributed by cybercriminals impersonating the Department of Government Efficiency (DOGE). The ransomware, spread via email and phishing attacks, is concealed in a ZIP file named 'Pay Adjustment.zip'. The infection chain involves a multi-stage operation, downloading various scripts and executables. The ransomware checks for sandbox environments, decrypts its payload, and drops a ransom note. FOG ransomware has targeted multiple sectors, including technology, education, manufacturing, and transportation. The campaign either involves original FOG operators using DOGE references to troll users or other actors embedding FOG ransomware for impersonation purposes.",
  "published": "2025-04-21T10:43:27+00:00",
  "created_at": "2025-04-21T10:43:27+00:00",
  "modified_at": "2025-04-21T11:15:22+00:00",
  "created_at_opencti": "2025-04-21T10:43:27+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2025-04-21",
    "data exfiltration",
    "doge",
    "foggyweb",
    "multi-stage",
    "phishing",
    "privilege-escalation",
    "ransomware",
    "sandbox evasion"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "dec35a94e4986765aa69635d02f09f58bfc8756b8fd5e1e9183b26eef0118667"
      },
      {
        "id": "",
        "name": "dc5370e1ab5b26ff04b9e34c6dbb37cf6c600b7ac9a394fd519b547b37a6d2d5"
      },
      {
        "id": "",
        "name": "8e209e4f7f10ca6def27eabf31ecc0dbb809643feaecb8e52c2f194daa0511aa"
      },
      {
        "id": "",
        "name": "44b7eebf7a26d466f9c7ad4ddb058503f7066aded180ab6d5162197c47780293"
      },
      {
        "id": "",
        "name": "3d2cbef9be0c48c61a18f0e1dc78501ddabfd7a7663b21c4fcc9c39d48708e91"
      },
      {
        "id": "",
        "name": "100cbf5578cfd03950c8606c6131a85635a8278696d3d64ecb629fa09af449e9"
      }
    ],
    "malware": [
      {
        "id": "57cad57d-a2e3-452e-b68a-3b18a1450cea",
        "name": "FoggyWeb - S0661",
        "slug": "foggyweb-s0661"
      }
    ],
    "intrusion_sets": [
      {
        "id": "legacy:intrusion:dfebbda7af181853",
        "name": "FOG",
        "slug": "fog"
      }
    ],
    "attack_patterns": [
      {
        "id": "32b33067-6566-4b8d-be80-e96f765d84de",
        "name": "T1059.001"
      },
      {
        "id": "93b2c4dd-5523-4464-8976-78754ee372fd",
        "name": "T1012"
      },
      {
        "id": "196f2a64-c55b-47a6-8e38-beb76ba700b6",
        "name": "T1204.002"
      },
      {
        "id": "dc17cbbd-40d8-43cf-b3cf-50d1276db2c7",
        "name": "T1016"
      },
      {
        "id": "70616b2f-4019-4963-b758-5d9f6f20e201",
        "name": "T1082"
      },
      {
        "id": "c473a756-355a-42ad-a0df-cd3a8fa006d1",
        "name": "T1057"
      },
      {
        "id": "45082a8e-9c79-470e-ad1b-decac7188e8f",
        "name": "T1083"
      },
      {
        "id": "c3af9fd7-d307-4df4-9220-cc627938fb85",
        "name": "T1055"
      },
      {
        "id": "5b7c66d1-0466-4ba7-af6f-eb82c2f9d05b",
        "name": "T1033"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "09124a92-c11f-4571-b35b-ab0bce6dd081",
        "name": "T1112"
      },
      {
        "id": "d9b45b3b-d093-4016-89e9-48f31ff4d05d",
        "name": "T1566"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "United States of America"
      },
      {
        "id": "",
        "name": "Consumer Services"
      },
      {
        "id": "",
        "name": "Business Services"
      },
      {
        "id": "",
        "name": "Retail"
      },
      {
        "id": "",
        "name": "Technology"
      },
      {
        "id": "",
        "name": "Healthcare"
      },
      {
        "id": "",
        "name": "Transportation"
      },
      {
        "id": "",
        "name": "Education"
      },
      {
        "id": "",
        "name": "Manufacturing"
      }
    ]
  },
  "external_refs": [
    "https://otx.alienvault.com/pulse/68063d6f5beb7958a54e2952"
  ]
}