CyberStack

Australia

fog

Fog, which uses the .flocked extension for encrypted files, was first observed in May in campaigns by Storm-0844, a threat actor known for distributing Akira. By June, Storm-0844 was deploying Fog more than Akira.

First seen 2021-12-20 · Last seen 2025-03-20 · 6 Australia claims

Cached from ransomware.live. 2026-09-19 PT. Leak sites are not linked.

Naphix

AU

Discovered: 2025-02-24 <span class="ransom-ago">(19mo ago)</span>

Extract from Gitlabs: Naphix, WDNA, Bayteq - gitlab

naphix.com

The University of Notre Dame Australia (nd.edu.au)

AU

Discovered: 2025-02-11 <span class="ransom-ago">(19mo ago)</span>

62 GB

nd.edu.au

RODS Surveying (rods.cc)

AU

Discovered: 2024-12-24 <span class="ransom-ago">(21mo ago)</span>

43.5 GB

rods.cc

Waverley Christian College (wcc.vic.edu.au)

AU

Discovered: 2024-12-17 <span class="ransom-ago">(21mo ago)</span>

5 GB

wcc.vic.edu.au

WPM Pathology Laboratory (wpmpath.com)

AU

Discovered: 2024-11-28 <span class="ransom-ago">(21mo ago)</span>

3 GB

wpmpath.com

Ultra Tune (ultratune.com.au)

AU

Discovered: 2024-10-18 <span class="ransom-ago">(23mo ago)</span>

3 GB

ultratune.com.au