Ransomware Attack on Hogan Mfg, Inc. by the Fog Ransomware Group

Hogan Mfg, Inc., a machinery manufacturing company based in the USA, fell victim to a ransomware attack by the notorious Fog Ransomware group. The attack was detected on November 22, 2024, impacting the company's website, hoganmfg.com. Hogan Mfg, Inc. is a well-established steel manufacturing fabricator known for its customer-centric approach. Founded in 1944, the company boasts a revenue of $10,000,000 and specializes in accessibility products for the mobility impaired, along with offering a range of manufacturing services across various industries.

Company Overview

Hogan Mfg, Inc. stands out in the industry for its commitment to quality, innovation, and sustainability. The company's focus on designing and producing accessibility products under the LIFT-U® brand showcases its dedication to serving the needs of mobility-impaired individuals. Additionally, Hogan Mfg, Inc. provides full-service contract manufacturing in sectors like aerospace, agriculture, and industrial machinery, utilizing advanced technologies and high-precision machinery for complex mechanical assemblies.

Attack Details

The ransomware attack on Hogan Mfg, Inc. resulted in the compromise of 10.5 GB of data, including sensitive files from categories such as human resources, internal financial documents, and accounting. The attackers also gained access to NDAs and driver licenses, posing a significant threat to the company's security and confidentiality.

Fog Ransomware Group

The Fog Ransomware group, also known as "Lost in the Fog," is a variant of the STOP/DJVU ransomware family that employs a double extortion tactic. This group is recognized for its sophisticated attack methods, including data encryption and threatening to leak sensitive information on the dark web if ransom demands are not met. Fog Ransomware has been linked to a surge in ransomware incidents, targeting organizations primarily in the education sector but expanding to lucrative industries like financial services.

Penetration and Vulnerabilities

Fog Ransomware likely penetrated Hogan Mfg, Inc.'s systems through compromised VPN credentials, exploiting weak RDP configurations, or phishing attacks. The group's use of tools like Cobalt Strike and Mimikatz for lateral movement within networks allowed for quick encryption of files. Hogan Mfg, Inc.'s vulnerabilities may have stemmed from inadequate cybersecurity measures, making them a target for threat actors like the Fog Ransomware group.

• Computer Weekly - Fog Ransomware Crew Evolving into Wide-Ranging Threat
• Arete Incident Response - Fog Ransomware Report
• Adlumin - Fog Ransomware Targeting Financial Sector
• Red Piranha - Fog Ransomware Overview
• Darktrace - Investigation into Fog Ransomware