Gitlabs: INGV, Spacemanic, Squeezer-software targeted by fog

• Ransomware group: fog
• Country: United States
• Sector: Technology
• Announcement date: February 12, 2025

Fog group claims data breach of three entities

The threat actor known as fog has published data allegedly belonging to INGV, Spacemanic, and Squeezer-software on their leak site. This announcement, which surfaced on February 12, 2025, marks a new development in the group's activities, targeting multiple organizations simultaneously.

Ransomware groups often utilize leak sites to exert pressure on victims through a tactic known as double extortion. In these scenarios, attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data. By threatening to release this stolen information publicly, the attackers aim to increase the likelihood of a ransom payment by leveraging the threat of reputational damage, regulatory scrutiny, and the loss of intellectual property.

The fog group provided specific details regarding the alleged theft, claiming that the data was obtained directly from the GitLab servers of the mentioned entities. According to the group's announcement, they have shared torrent links for the datasets associated with each organization. Each of these datasets is stated to be 7 GB in size, totaling an alleged 21 GB of stolen information across the three targets.

Details of the alleged data theft

The information provided by the threat actor suggests a targeted approach toward development environments. The group's claim focuses on the contents of GitLab, which is a critical platform for software development and version control. When such servers are compromised, the potential impact on an organization can be significant.

The following data types are identified as being affected according to the group's claims:

• GitLab server data

While the specific nature of the files within these 7 GB datasets has not been detailed beyond their origin, the exposure of GitLab environments typically carries inherent risks. In a general context, such breaches can lead to the disclosure of source code, sensitive configuration files, and internal documentation. Such information can be used by attackers to facilitate secondary attacks or to identify vulnerabilities within the software supply chain.

Analysis of the threat and potential impact

The claims made by the fog group pose significant risks to the intellectual property and the operational continuity of INGV, Spacemanic, and Squeezer-software. The exposure of sensitive technical data, such as that found on GitLab servers, can lead to the disclosure of proprietary source code and critical configuration information. This exposure may create new attack vectors for the organizations and introduce risks to the broader supply chain.

Furthermore, for entities operating within certain jurisdictions, such breaches may trigger legal consequences. For example, European-based entities may face scrutiny and potential legal sanctions under the General Data Protection Regulation (GDPR) if personal data is found to be part of the breach. The scale and nature of the alleged 21 GB of data may necessitate a comprehensive review of the organizations' existing security processes and incident response protocols.

To mitigate the risks associated with such attacks, organizations in the technology sector often implement defensive strategies such as multi-factor authentication (MFA), strict access controls, and continuous monitoring of development environments. Strengthening the security of version control systems is a critical component of a robust cybersecurity posture, as these systems often contain the