ZeroHour

cloak

ransomware group · unknown · active since 2026-06-16 (earliest leak-site post tracked by this dashboard; earlier activity unknown)

Victims · 7d
0flat
Victims · 30d
0active targets
Victims · 90d
1
All-time (tracked)
151since 2023-08-24
Last post
06-18 22:25UTC
Estimated earnings
public reporting
Profile · glm-5.3-flash · updated

Cloak is a data-theft and extortion brand known primarily from its public leak site, and the operators' origin, aliases, and affiliate lineage remain unknown. This dashboard first tracked the brand on 2026-06-16 and recorded four victim listings within the following 90 days, none after 2026-06-18, with several additional recent victim entries visible only in partially masked form. Identified victims span Germany and the United States - a German law firm, a German corporate group, a New York hotel group, and a Virginia municipal government - indicating opportunistic, multi-sector targeting across two regions. The very low publication rate may reflect small affiliate capacity, selective targeting, or victims resolving incidents without being listed, so an idle leak site should not be read as inactivity. No widely reported vendor research, law-enforcement advisories, or blockchain-analytics reporting yet ties the group to specific operators, exploited vulnerabilities, or ransom-payment figures.

Tactics & tooling
  • Data-theft extortion with public leak-site victim listings (double-extortion pattern)
  • Targets organizations in both the United States and Germany
  • Victim mix spans municipal government, legal, hospitality, and industrial/corporate targets, indicating opportunistic rather than single-vertical selection
  • Very low publication volume (4 tracked listings in 90 days; none since 2026-06-18)
  • Initial access techniques, malware tooling, and exploited vulnerabilities: unknown (no public technical reporting)
Targeted sectors
Government (local/municipal)Legal servicesHospitality (hotels)Industrial/corporate
Notable public victims

suffolkva.us - City of Suffolk, Virginia (municipal government), Fitzpatrickhotels.com - Fitzpatrick Hotels (New York City hotel group), Dinnebiergruppe.de - Dinnebier Gruppe (German corporate group), ra-vogeler.de - German law firm ('RA' indicates Rechtsanwaltskanzlei)

Estimated earnings

No public figure.

Leak-site victims

VictimDiscoveredDetails
ab*******.org · Jun 20, 2024
Baeckerei-raddatz.de · May 30, 2024
Rul**********.de · May 30, 2024
cli*********.com · May 5, 2024
bae************.de · May 5, 2024
Speditionweise.de · Apr 29, 2024
Wencor.com · Apr 29, 2024
Theharriscenter.org · Apr 29, 2024
Mu*****.eu · Apr 29, 2024
Cv*****.com · Apr 29, 2024
Ce***.com · Apr 29, 2024
B*****.hu · Apr 29, 2024
Forgepresion.com · Mar 25, 2024
Ponoka.ca · Mar 25, 2024
Vhs-vaterstetten.de · Mar 25, 2024
Gascontec.com · Mar 25, 2024
Equatorial Energia · Mar 25, 2024
we****.com · Mar 25, 2024
The************.org · Mar 25, 2024
Sped**********.de · Mar 25, 2024
Maas911.com · Jan 8, 2024
farwickgrote.de · Dec 3, 2023
skncustoms.com · Dec 3, 2023
euro2000-spa.it · Dec 3, 2023
Thenewtrongroup.com · Dec 3, 2023
Bankofceylon.co.uk · Dec 3, 2023
carranza.on.ca · Dec 3, 2023
Arus-gmbh · Aug 24, 2023
Sportlab-srl · Aug 24, 2023
BONI-PASSAU.DE · Aug 24, 2023
lusis-avocats.com · Aug 24, 2023
werk33.com · Aug 24, 2023
GRIDINSTALLERS.com · Aug 24, 2023
surapon.com · Aug 24, 2023
mps-24.com · Aug 24, 2023
gruppomoba.com · Aug 24, 2023
stshcpa.com.tw · Aug 24, 2023
ihopmexico.com · Aug 24, 2023
Nicer technology · Aug 24, 2023
binhamoodah.ae · Aug 24, 2023
first-resources-ltd · Aug 24, 2023
Sbs-Berlin · Aug 24, 2023
imtmro.com · Aug 24, 2023
INCOBEC · Aug 24, 2023
still95.it · Aug 24, 2023
gsh-cargo.com · Aug 24, 2023
flamewarestudios.com · Aug 24, 2023
ALEZZELPOWER.com · Aug 24, 2023
Notaires.fr · Aug 24, 2023
Sonabhy.bf · Aug 24, 2023

In the newsAll →

No articles mention this group yet.

Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .