All of the attacks also entailed the utilization of previously stolen credentials to infiltrate VPN gateways without multi-factor authentication, some of which were on outdated software, according to a report from Sophos X-Ops researchers. “In the Fog ransomware incident, the attacker deployed it to an unprotected Hyper-V server, then used the utility rclone to exfiltrate data,”

Source: SC Magazine