Overview 

Frog is a ransomware operator that first surfaced in November 2024. It is tracked by the threat intelligence community under different aliases, including STAC5881. The group runs a standard double-extortion playbook: exfiltrate first, encrypt second, then apply pressure on both fronts. Files touched by its encryptor carry the [.]frag extension, and victims are left a ransom note named README.TXT directing them to a Tor-hosted negotiation portal.  

A notable pressure tactic in Frag’s playbook is pushing victims to self-report the breach internally to management, adding a layer of psychological urgency beyond the usual leak-site threat. The group’s initial footprint was almost entirely U.S.-based; that footprint has since widened to Argentina, Jamaica, the Netherlands, and Singapore.  

At the time of writing, Frag had claimed at least 29 victims across 15 industry verticals in under two years of activity — a fast ramp for a group still being profiled. 

Emergence and Attribution 

Frag has no confirmed nation-state backing and is treated as a financially motivated criminal enterprise rather than an espionage actor. What sets it apart from a purely independent operation is the overlap analysts have found with its neighbors in the ransomware ecosystem: code and behavioral similarities tie Frag to the Hellcat and Morpheus ransomware families, along with a variant called AidLocker. 

That overlap points toward a shared-resource model — a malware-as-a-service arrangement or an affiliate structure — rather than Frag building its toolkit from scratch. For defenders, this matters: detection signatures written for Hellcat or Morpheus may have partial coverage against Frag, and vice versa. 

Targeting Profile 

Frag’s victim selection is broad rather than sector-specific, which is itself a signal — it points to opportunistic targeting of exposed VPN infrastructure rather than a deliberate campaign against one industry. Industries hit include: 

• Aerospace & Defense 

• BFSI 

• Healthcare and Pharmaceuticals & Biotechnology 

• Energy & Utilities 

• Manufacturing 

• Technology, IT & ITES, and Telecommunication 

• Transportation & Logistics 

• Construction, Real Estate, Hospitality, Food & Beverages, and Professional Services 

Region	Countries
North America	United States
Latin America & Caribbean	Argentina, Jamaica
Europe	Netherlands
Asia-Pacific	Singapore

The concentration remains heavily U.S.-weighted, with the Netherlands and Singapore cases emerging from a single data-leak-site disclosure batch rather than sustained regional campaigns — worth watching for whether that becomes a pattern or stays incidental. 

Recent Security Incidents Claimed by the Frag Ransomware Group 

A Singapore-based biobanking services provider (claimed 12 Jun 2025). Frag claimed responsibility for compromising a biobanking and reproductive health services firm, alleging theft of financial statements and internal reporting documents.  

As of the disclosure, no confirmed exposure of personally identifiable or protected health information had been reported — a distinction that matters for a healthcare-adjacent target, where PHI exposure carries separate regulatory weight from a generic data breach. 

A U.S.-headquartered optical communications manufacturer with Asian operations (claimed 04 Apr 2025). This case stands out for its supply-chain angle: the victim’s business spans manufacturing operations across Asia, and the claimed data haul included financial statements, partnership agreements, licensing contracts, and employee passport records.  

A telecom-hardware supplier with cross-border manufacturing ties is exactly the kind of target where a breach ripples outward to partners and downstream customers, not just the company itself. 

A multi-victim data-leak-site launch spanning logistics and technology firms in the U.S., Netherlands, and Singapore (20 Mar 2025). This is the incident that put Frag on the map as an operator rather than a one-off.  

It has been found that both Windows and Linux ransomware samples tied to an onion-based leak site, with 25 victims identified at the time — the large majority U.S.-based, with a smaller number in the Netherlands and Singapore. 

Tooling and Malware Ecosystem 

Frag’s toolkit is intentionally unglamorous — it leans on legitimate, dual-use software (LOLBins) rather than custom malware, which is precisely what makes it hard to flag on endpoint telemetry: 

Each of these has legitimate enterprise use, which is exactly the point — an analyst watching for WinSCP or rclone traffic on an admin’s machine has to separate normal IT activity from an active exfiltration run. Frag compounds this with a Bring-Your-Own-Vulnerable-Driver (BYOVD) technique — deploying AuKill to kill EDR and antivirus processes at the kernel level before the payload lands. 

The group’s other signature move is privilege escalation via CVE-2024-40711, a deserialization flaw in Veeam Backup & Replication that gives remote code execution. Combined with backup deletion later in the chain, this is a deliberate one-two punch aimed squarely at recovery capability, not just data confidentiality. 

Initial Access and Execution Techniques 

Frag’s attack chain is procedural and repeats with little variation across incidents: 

• Initial access: Exploitation of internet-facing VPN appliances — no phishing lure required, just exposed infrastructure. 

• Privilege escalation: CVE-2024-40711 against Veeam Backup & Replication, opening a path to deeper system control. 

• Persistence: Rogue local administrator accounts created under generic usernames — “point” and “point2” recur across cases, suggesting a scripted or templated deployment rather than manual, case-by-case tradecraft. 

• Defense evasion: AuKill (BYOVD) disables security tooling; LOLBins mask exfiltration as routine admin activity. 

• Impact: Backup destruction (Veeam-focused) precedes encryption, closing off recovery before the ransom note ever drops. 

This is a group optimizing for reliability over sophistication — every stage reuses known, working techniques rather than custom exploit development, which mirrors the “known-vulnerability” pragmatism seen in longer-running ransomware crews. 

Conclusion 

Frag has rapidly evolved into a global ransomware threat, relying on disciplined operations rather than advanced malware. Its reported links to Hellcat, Morpheus, and AidLocker suggest the group may be part of a broader affiliate ecosystem. Cyble helps organizations stay ahead of such threats with AI-powered Cyber Threat Intelligence, Dark Web Monitoring, Attack Surface Management, and Digital Risk Protection, enabling security teams to detect risks early and respond faster. 

Schedule a demo with Cyble to see how AI-driven threat intelligence can strengthen your cyber defenses. 

MITRE ATT&CK Techniques Associated with Frag 

• Exploit Public-Facing Application (T1190 | Initial Access): Compromises internet-facing VPN appliances to establish an initial foothold. 

• PowerShell (T1059.001 | Execution): Uses PowerShell for payload execution and system control, consistent with related ransomware families. 

• Create Account: Local Account (T1136.001 | Persistence): Establishes rogue local admin accounts under generic usernames (“point,” “point2”) to preserve access. 

• Exploitation for Privilege Escalation (T1068 | Privilege Escalation): Leverages CVE-2024-40711 in Veeam Backup & Replication for deeper access. 

• Masquerading (T1036 | Defense Evasion): Uses legitimate tools (rclone, WinRAR, WinSCP) to blend malicious activity into normal admin behavior. 

• Exploitation for Defense Evasion (T1211 | Defense Evasion): Deploys AuKill via BYOVD to disable AV/EDR protections. 

• OS Credential Dumping (T1003 | Credential Access): Likely credential harvesting to support lateral movement, consistent with peer ransomware operations. 

• File and Directory Discovery (T1083 | Discovery): Locates backup systems and high-value files ahead of encryption. 

• Remote Services (T1021 | Lateral Movement): Probable use of RDP/SMB for internal network movement post-persistence. 

• Automated Collection (T1119 | Collection): Scripts data collection ahead of exfiltration. 

• Exfiltration Over C2 Channel (T1041 | Exfiltration): Transfers packaged data via rclone, WinSCP, and WinRAR to attacker infrastructure. 

• Data Encrypted for Impact (T1486 | Impact): Encrypts victim files with the .frag extension and drops a README.TXT ransom note. 

• Inhibit System Recovery (T1490 | Impact): Deletes backup files, particularly Veeam-related, to remove recovery options and increase ransom leverage.