During trend Micro researchers monitoring of the ransomware threat landscape, they discovered samples with infection chain characteristics and payloads that can be attributed to FOG ransomware.
A total of nine samples were uploaded to VirusTotal between March 27 and April 2, which the researchers recently discovered were multiple ransomware binaries with .flocked extension and readme.txt notes. Trend Micro observed that these samples initially dropped a note containing key names related to the Department of Government Efficiency (DOGE), an initiative of the current US administration that has been making headlines, recently about a member who allegedly assisted a cybercrime group involved in data theft and cyberstalking an agent of the Federal Bureau of Investigation (FBI). The note also contains instructions to spread the ransomware payload to other computers by pasting the provided code in the note.
Read more…
Source: Trend Micro
Sign up for our Newsletter
The latest news and insights delivered right to your inbox.
Related:
- Shipping giant Maersk confirms data breach as hackers demand $5 million ransom
November 12, 2026
One of the world’s largest shipping and logistics companies, A.P. Moller–Maersk (often just called Maersk) has confirmed it recently suffered a cyberattack in which it lost sensitive data from one of its earlier acquisitions. The criminals are now trying to pressure the company into paying a ransom, threatening to release all of the stolen information on ...
- Attackers use Autonomous AI to target semiconductor, defense and civil society sectors
November 12, 2026
From August–September 2026, Chinese-speaking attackers used an open-source AI penetration testing framework called Cairn to autonomously conduct 25 operations against at least 19 organizations. The attackers weaponized Cairn by pairing it with Chinese AI models Zhipu GLM and DeepSeek. The attackers supplied a target and a goal, then Cairn planned, executed and recorded results on its ...
- Hackers exploiting ScreenConnect plugin flaw to spread malware across hundreds of PCs
November 12, 2026
Hackers have used a dodgy third-party ScreenConnect extension to push malware onto at least 288 machines across 48 organizations, prompting ConnectWise to disable a handful of plugins in hundreds of customer environments. Security outfit Huntress first raised the alarm in a Reddit post on Wednesday, warning of an active campaign targeting cloud-hosted ScreenConnect instances. At the ...
- Remus malware claims Gmail access even after you change your password
November 11, 2026
Changing your password should be part of recovering a compromised account. The developers of Remus Stealer are advertising a Gmail-reading feature they claim can survive that step and even session revocation. That is a serious claim. It is not, however, a demonstrated capability in the published investigation. Threat intelligence company Hudson Rock examined Remus’s promotional material ...
- Japan’s furniture giant Nitori says hackers stole 37.6 million customer records
November 11, 2026
Japan’s largest furniture chain Nitori Holdings has disclosed suffering a cyberattack which saw it lose tens of millions of customer records. Both consumer and business customers are affected, but passwords and payment data have not been compromised. In a statement, Nitori said it spotted unauthorized access to its systems on November 6 2026 – and after ...
- 13.3 million people’s medical data exposed; companies pay $300,000
November 9, 2026
The New York attorney general (AG) has reached a settlement over a medical data breach that affected 13.3 million people after basic security failures. Perry Johnson & Associates (PJ&A) and four related companies have agreed to pay $300,000 and implement extensive security reforms following a breach that exposed personal and medical information belonging to more than ...