cloak
Ransomware group profile
Description
Cloak is a sophisticated ransomware group that emerged in early 2022, notorious for its stealth and advanced evasion methods. Primarily targeting small to medium-sized businesses, they leverage custom malware and zero-day vulnerabilities to conduct their operations, often employing a multi-faceted extortion strategy. Their tactics include double and triple extortion methods, where they threaten data leaks and DDoS attacks on victims who refuse to pay.
Key insights
- •Utilizes zero-day vulnerabilities and custom malware for infiltration and data encryption.
- •Employs spear-phishing for initial access, often using malicious attachments.
- •Known for multi-layered extortion tactics, combining data encryption, theft, and threats of public release.
- •Targets various sectors, notably healthcare and finance, with high payment rates from victims.
- •Increasingly leveraging initial access brokers to penetrate networks of high-value targets.
- •Shifts towards 'triple extortion' by including DDoS attacks against non-compliant victims.
Threat Level & Status Breakdown
For cloak · Based on incidents in selected period
Recent activity
Monthly attack count for cloak in the selected period
Intelligence
IOCs, YARA/Sigma rules, and related families for cloak
- a53a9ca8a074c7108f8412c3f8c1fc5d
- 77962a384d251f0aa8e3008a88f206d6cb1f7401c759c4614e3bfe865e3e985c
- 3928c5874249cc71b2d88e5c0c00989ac394238747bb7638897fc210531b4aab
- 7007cf53bcd0083baba202d8ac2d9070
- a98dcdee82f6066a4cf2f9d7d161a1bacec8f81d
- 94f73b5dc06ba6705fcef3e759413a747049c2949a0c2e44afc03b2f9989cf73
- d1038be644a0da3ba05922fa27db4167a6e17451
- 1e074d9dca6ef0edd24afb2d13ca4429def5fc5486cd4170c989ef60efd0bbb0
- c3804d1329b55a37bfa2f835e1e9bbc7bdb2b260f8e3627c06e02c9f52685d44
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for cloak
T1486
T1486
T1490
T1490
T1078
T1078
T1059
T1059
T1547
T1547
T1021
T1021
T1562
T1562
T1021.001
T1021.001
T1090
T1090
T1003
T1003
T1105
T1105
T1041
T1041
Victims(23)
| Company | Domain | Country | Industry | Status | Discovered | |
|---|---|---|---|---|---|---|
| ra-vogeler.de | ra-vogeler.de | DE Germany | Professional Services | Unknown | about 23 hours ago | |
| ra-*******e | — | — | — | Unknown | 3 days ago | |
| d**********e | — | — | — | Unknown | 3 days ago | |
| W******S*******D | — | — | — | Unknown | 3 days ago | |
| suffolkva.us | suffolkva.us | US United States | Government & Defense | Unknown | 4 months ago | |
| ****el-p*****.de | — | DE Germany | — | Unknown | 4 months ago | |
| Dinnebiergruppe.de | dinnebiergruppe.de | DE Germany | Retail & E-Commerce | Unknown | 4 months ago | |
| ****ne*i***pe.de | — | DE Germany | — | Unknown | 5 months ago | |
| Fitzpatrickhotels.com | fitzpatrickhotels.com | US United States | Hospitality | Unknown | 6 months ago | |
| ****patr**h**s.com | — | NA Namibia | Technology | Unknown | 6 months ago | |
| *****l*****.us | — | US United States | — | Unknown | 6 months ago | |
| ****e-det**.de | — | DE Germany | — | Unknown | 7 months ago | |
| *****.com | — | NA Namibia | Retail & E-Commerce | Unknown | 8 months ago | |
| L********den.com | — | NA Namibia | — | Unknown | 8 months ago | |
| TuftsMedicine | tuftsmedicine.org | US United States | Healthcare | Unknown | 10 months ago | |
| Wstg-steuerberater.de | wstg-steuerberater.de | DE Germany | Professional Services | Unknown | 10 months ago | |
| Tu*******ne | — | — | — | Unknown | 10 months ago | |
| Go********l | — | NA Namibia | — | Unknown | 10 months ago | |
| *********.bh | — | BH Bahrain | — | Unknown | 10 months ago | |
| *******roup.ro | — | RO Romania | — | Unknown | 10 months ago |
Page 1 of 2
Affected countries(29)
Countries where this group has been reported to target or leak victims.