Fog Ransomware GC2 Beaconing and VSS Deletion Activity

Ankit Mehta@Secvyn

•updated Jun 26, 2026•0•0•1

Detects a specific beaconing pattern associated with Fog Ransomware, characterized by a non-browser process making OAuth2 token requests to Google accounts followed by Drive/Sheets API calls, correlated with the deletion of volume shadow copies (VSS) for recovery inhibition.