Fog ransomware assaults over the last month have included a new ransom note mentioning the US Department of Government Efficiency (DOGE) and enticing victims to propagate the malware to other PCs, Trend Micro said earlier this week.
Analysis of the latest samples of Fog ransomware, which were published to VirusTotal between March 27 and April 2, 2025, found that they propagated via the transfer of a ZIP file containing an LNK file disguised as a PDF called "Pay Adjustment." This shows that attacks were carried out via phishing emails to employees.
Once the "Pay Adjustment" LNK file is clicked, a PowerShell script named stage1.ps1 is executed, which retrieves multiple payloads from a hacker-controlled domain. These include the ransomware loader cwiper.exe, a bring-your-own-vulnerable-driver (BYOVD) privilege escalation tool named Ktool.exe, a QR code image directing to a Monero wallet, a ransom letter called RANSOMNOTE.txt, and more malicious PowerShell scripts.
Ktool.exe extracts the vulnerable Intel Network Adapter Diagnostic Driver iQVW64.sys to the %TEMP% folder, passing the target process ID (PID) and a hardcoded key as arguments. Lootsubmit.ps1 and Trackerjacker.ps1 are PowerShell scripts that collect and exfiltrate system information such IP addresses, CPU configurations, MAC addresses, and system geolocations.
Before dropping the Fog ransomware, the ransomware loader checks to ensure it is not in a sandbox environment. It also drops dbgLog.sys, which tracks encryption-related activities, and readme.txt, an additional ransom note. This ransom note is identical to those found in past Fog ransomware assaults.
Odd political references
While the final ransom note, readme.txt, is identical to prior attacks, the initial ransom note, RANSOMNOTE.txt, refers to DOGE and includes the names of specific individuals involved with the department.
The note reads, "Give me five bullet points on what you accomplished for work last week," and refers to emails sent to federal employees in February as part of a DOGE campaign. The note further offers to decrypt the user's data for free if they deliver the malicious files to another person or manually execute the malicious PowerShell commands on someone else's PC.
Earlier this year, the DoNex ransomware group followed a similar tactic, promising payment to targets in exchange for sharing sensitive company data or spreading the malware throughout their organisation. The PowerShell script also contains bizarre political references, such as the statement "The CIA didn't kill Kennedy, you idiot." The script also launched several politically orientated YouTube videos, including an episode of "Last Week Tonight with John Oliver.”
