Japan

fog

Fog, which uses the .flocked extension for encrypted files, was first observed in May in campaigns by Storm-0844, a threat actor known for distributing Akira. By June, Storm-0844 was deploying Fog more than Akira.

First seen 2021-12-20 · Last seen 2025-03-20 · 1 Japan claims

Cached from ransomware.live. 2026-10-01 PT. Leak sites are not linked.