FOG Ransomware Breach Hits Fromm International
FOG Ransomware Group Targets Fromm International: A Detailed Analysis
Fromm International, a longstanding leader in the beauty industry, has recently fallen victim to a ransomware attack orchestrated by the FOG ransomware group. This incident underscores the growing threat of cybercrime in the consumer services sector, particularly for companies with a significant digital footprint.
About Fromm International
Founded in 1907, Fromm International has evolved from its origins as the Illinois Razor Strop Company into a major player in the beauty industry. The company is renowned for its high-end salon tools and accessories, serving both professional and consumer markets. With a facility spanning 70,000 square feet in Mt. Prospect, Illinois, and employing approximately 57 individuals, Fromm generates an estimated annual revenue of $31.7 million. Its commitment to quality and innovation has solidified its reputation, making it a standout in the beauty sector.
Details of the Ransomware Attack
The FOG ransomware group claims to have exfiltrated 16 GB of sensitive data from Fromm International. This breach potentially exposes critical information, including customer details and credit card data, posing a significant risk to customer privacy and financial security. The attack highlights vulnerabilities in Fromm's cybersecurity infrastructure, which may have been exploited through compromised VPN credentials or known application vulnerabilities.
FOG Ransomware Group Profile
First identified in November 2021, the FOG ransomware group is a variant of the STOP/DJVU family. It is known for its rapid encryption capabilities and sophisticated attack mechanisms, including privilege escalation and data exfiltration. The group has recently shifted its focus to more lucrative targets, such as the financial sector, but continues to pose a threat across various industries.
Potential Penetration Methods
FOG ransomware typically gains initial access through compromised VPN credentials or by exploiting known vulnerabilities in applications. Once inside, it employs techniques like pass-the-hash attacks to escalate privileges and encrypt critical files, including virtual machine disks. The group's ability to delete backups further complicates recovery efforts, making it a formidable adversary for companies like Fromm International.
Sources
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!