Cybercrooks spreading malware and trolling victims using DOGE jargon

Fog ransomware operators are now using DOGE-themed ransom notes to troll their victims, a new cybersecurity investigation has found.

According to Trend Micro researchers, the latest Fog attacks begin with phishing emails containing a zip archive titled “Pay Adjustment.zip,” packed in a malicious LNK file.

When the victim clicks on the file, it triggers a series of actions that ultimately drop the ransomware onto the system. Trend Micro says that Fog ransomware has claimed 100 victims since January.

Most of the victims so far have been from the technology, manufacturing, education, and transportation sectors, the researchers added in a blog post. Other targeted sectors include healthcare, retail, and consumer services.

The ransom notes are especially interesting, though. They seemingly contain references to Elon Musk’s controversial – and still unofficial – Department of Government Efficiency (DOGE).

For example, one note mockingly asked the victim to list, in bullet form, five tasks they have accomplished over the past week or to pay the ransomware actor a trillion dollars.

There’s also a QR code that victims can use to make a ransom payment to a Monero wallet address. “Don’t snitch now,” the note says. “We grabbed your trilatitude and trilongitude (the most accurate) coordinates of where you live.”

In February, DOGE indeed commanded all US federal workers to submit weekly emails listing five accomplishments with an email bearing the subject line “What did you do last week?” Nobody’s complying, though, and the directive is essentially dead.

DOGE’s team of technologists is still active, although The Washington Post recently said that Musk is readying his exit from the government. His status as a special government employee is expected to expire at the end of May.

According to Trend Micro, Fog ransomware is a relatively new ransomware family that enterprises must add to their watchlist.

“Regardless of the origins and motivations behind the Fog ransomware samples we investigated, whether executed by the original operators using DOGE references for trolling purposes or by other actors embedding Fog ransomware into their binaries for impersonation, the impact of a successful ransomware attack could still potentially cost enterprises financial loss and operational disruption,” said the cybersecurity company.