Cloak — Ransomware Profile
Cloak is a ransomware-as-a-service operation active since late 2022, primarily targeting small-to-medium enterprises in Europe, especially Germany, across manufacturing, healthcare, education, and government sectors, with expansion into North American and Asian targets by 2025.Recent claimed victims
- ra-vogeler.de 2026-06-18
Vendor research
- Click, Clock... Analyse des TTPs du ransomware Cloak OWN Security (OWN-CERT)
- Cloak Ransomware Variant Exhibits Advanced Persistence, Evasion and VHD Extraction Capabilities Halcyon (Halcyon RISE Team)
- Threat Actor Interplay | Good Day's Victim Portals and Their Ties to Cloak SentinelOne (SentinelLabs)
- Cloak Ransomware: Who's Behind the Cloak? Cyberint (Check Point External Risk Management)