Fog

A ransomware operation active since 2024 that initially concentrated on education and later broadened to other sectors. Its intrusions commonly use compromised VPN credentials, rapid lateral movement, data theft, and encryption, with variants and infrastructure evolving over time.