FOG ransomware gang abuses employee monitoring tools in unusual multi-stage attack

FOG ransomware hackers are known for targeting American educational institutions and now use legitimate employee monitoring software Syteca, as well as several open source pen testing tools, as well as usual encryption.

In investigating the May 2025 attack on an unnamed financial institution in Asia, Symantec researchers discovered hackers using Syteca (formerly Ekran) and several pen testers including GC2, Adaptix and Stowaway, who discovered this behavior in the Ransomware attack chain.

Bugcrowd’s CISO Trey Ford reflects on the shift in Fog’s tactics, saying: “We should expect to use ordinary and legal enterprise software as the norm – we call it “live on land.” Why would attackers introduce new software, create more noise in logs, and add when the allowed software can give them when to work for it?”