Fog Ransomware Group Blurs Lines Between Cybercrime and Espionage in Sophisticated Attack

In May 2025, the Fog ransomware group launched a highly advanced campaign against a financial institution in Asia, marking a significant evolution in ransomware tactics. Departing from traditional methods, the group employed a wide array of legitimate penetration testing and employee monitoring tools to infiltrate and persist within the target network.

This operation stands out for its use of software rarely seen in ransomware attacks, including Syteca employee monitoring tools, the GC2 command-and-control (C2) framework, Adaptix C2 Agent Beacon, and Stowaway proxy tools. Symantec analysts flagged the attack as highly atypical due to this unconventional toolkit.

The attackers gained access—likely via Exchange Servers, though the entry vector remains unconfirmed—and maintained a two-week foothold before deploying the ransomware payload. During this time, they conducted extensive reconnaissance and lateral movement using standard discovery commands like whoami, net use, and various network enumeration techniques.

GC2, a tool previously linked to APT41 and known for using Google Sheets and Microsoft SharePoint for command execution and data exfiltration, was repurposed by the attackers. Its use of legitimate cloud services enabled stealthy operations that bypassed traditional detection methods.

Perhaps most notably, the attackers established long-term persistence even after deploying ransomware. They created a service-based backdoor—SecurityHealthIron—described as “Collect performance information about an application by using command-line tools.” This backdoor was implemented using the sc create command and paired with process watchdogs monitoring GC2 activity.

These post-deployment actions point to a dual-purpose strategy: ransomware as a smokescreen for sustained espionage. The campaign reflects a paradigm shift in threat actor behavior, where financial motives are intertwined with intelligence objectives, and advanced persistence mechanisms are now integral to ransomware operations.