Security analysts have tracked a sophisticated ransomware campaign by the “Fog” group, which targets financial institutions using a stealthy tactic: weaponising legitimate IT and cybersecurity tools. Instead of deploying obvious malware, the attackers rely on trusted applications to move laterally, gather intelligence, and launch their ransomware payloads.
The campaign leveraged penetration testing frameworks, such as Cobalt Strike and Brute Ratel, along with commercially available employee-monitoring software, including NetMonitor and ActivTrak. These tools, commonly used for red-teaming or compliance tracking, were repurposed to exfiltrate data and establish persistence in compromised environments.
By blending into normal IT activity, Fog operatives successfully evaded traditional endpoint detection and security alerting. The use of widely whitelisted tools gave them the advantage of stealth, while data exfiltration before encryption indicated a dual-motive operation, monetary ransom and strategic espionage.
Most victims were concentrated in financial hubs across Southeast Asia, with reports suggesting attackers spent days to weeks inside networks before triggering ransomware deployment. This campaign underscores the rising threat of “tool hijacking”, where the line between benign and malicious activity is increasingly blurred. Financial institutions and security teams must re-evaluate how trusted tools are deployed and monitored, implementing stricter access policies, real-time behaviour analytics, and segmentation controls to stay ahead.
