ZeroHour

cloak

ransomware group · unknown · active since 2026-06-16 (earliest leak-site post tracked by this dashboard; earlier activity unknown)

Victims · 7d
0flat
Victims · 30d
0active targets
Victims · 90d
1
All-time (tracked)
151since 2023-08-24
Last post
06-18 22:25UTC
Estimated earnings
public reporting
Profile · glm-5.3-flash · updated

Cloak is a data-theft and extortion brand known primarily from its public leak site, and the operators' origin, aliases, and affiliate lineage remain unknown. This dashboard first tracked the brand on 2026-06-16 and recorded four victim listings within the following 90 days, none after 2026-06-18, with several additional recent victim entries visible only in partially masked form. Identified victims span Germany and the United States - a German law firm, a German corporate group, a New York hotel group, and a Virginia municipal government - indicating opportunistic, multi-sector targeting across two regions. The very low publication rate may reflect small affiliate capacity, selective targeting, or victims resolving incidents without being listed, so an idle leak site should not be read as inactivity. No widely reported vendor research, law-enforcement advisories, or blockchain-analytics reporting yet ties the group to specific operators, exploited vulnerabilities, or ransom-payment figures.

Tactics & tooling
  • Data-theft extortion with public leak-site victim listings (double-extortion pattern)
  • Targets organizations in both the United States and Germany
  • Victim mix spans municipal government, legal, hospitality, and industrial/corporate targets, indicating opportunistic rather than single-vertical selection
  • Very low publication volume (4 tracked listings in 90 days; none since 2026-06-18)
  • Initial access techniques, malware tooling, and exploited vulnerabilities: unknown (no public technical reporting)
Targeted sectors
Government (local/municipal)Legal servicesHospitality (hotels)Industrial/corporate
Notable public victims

suffolkva.us - City of Suffolk, Virginia (municipal government), Fitzpatrickhotels.com - Fitzpatrick Hotels (New York City hotel group), Dinnebiergruppe.de - Dinnebier Gruppe (German corporate group), ra-vogeler.de - German law firm ('RA' indicates Rechtsanwaltskanzlei)

Estimated earnings

No public figure.

Leak-site victims

VictimDiscoveredDetails
ge*******.com · Jan 21, 2025
Mai***********.de · Dec 30, 2024
bac***********.com.au · Dec 30, 2024
Town of Ponoka · Dec 30, 2024
Kai*************.de · Dec 19, 2024
Ne***********.de · Dec 19, 2024
Fmp.gob.pe · Dec 11, 2024
N************.uk · Dec 10, 2024
Orthopaedie-hof.de · Dec 9, 2024
Ukh-hof.de · Dec 9, 2024
Donnewalddistributing · Dec 4, 2024
Bw**********.at · Nov 28, 2024
Ma************.de · Nov 28, 2024
Or*************.de · Nov 28, 2024
Uk***********.de · Nov 28, 2024
Globalresultspr.com · Nov 19, 2024
don****************.com · Nov 16, 2024
F************.pe · Nov 16, 2024
SCAFF'HOLDING · Nov 6, 2024
Glo**************.com · Nov 6, 2024
o******************v · Nov 6, 2024
mm********.com · Oct 21, 2024
Wertachkliniken.de · Sep 28, 2024
Pennvet.com · Sep 28, 2024
Ful************.com · Sep 28, 2024
Te***************.net · Sep 28, 2024
Pen*****************.com · Sep 15, 2024
El**********.hu · Sep 15, 2024
we****************.de · Sep 15, 2024
Kalaswire.com · Aug 22, 2024
Dunlop Aircraft Tyres · Aug 22, 2024
Vibo.dk · Aug 22, 2024
Hvb-ingenieure.de · Aug 22, 2024
Westermans.com · Aug 22, 2024
Stjamesplace.org · Aug 22, 2024
Dd*******uk · Aug 22, 2024
Entr**************.fr · Aug 22, 2024
Cb**********.com · Aug 22, 2024
upcli.com · Jul 20, 2024
Vi*********.dk · Jul 20, 2024
Hv*************.de · Jul 20, 2024
We*******.com · Jul 20, 2024
Ka******.com · Jul 20, 2024
Dun*****************uk · Jul 9, 2024
Longviewbridge.com · Jul 2, 2024
Ruland-viersen.de · Jul 2, 2024
P********.pl · Jul 2, 2024
Unit*****************.com · Jul 2, 2024
Mundocar.eu · Jun 20, 2024
lo***********.com · Jun 20, 2024

In the newsAll →

No articles mention this group yet.

Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .