cloak
ransomware group · unknown · active since 2026-06-16 (earliest leak-site post tracked by this dashboard; earlier activity unknown)
Cloak is a data-theft and extortion brand known primarily from its public leak site, and the operators' origin, aliases, and affiliate lineage remain unknown. This dashboard first tracked the brand on 2026-06-16 and recorded four victim listings within the following 90 days, none after 2026-06-18, with several additional recent victim entries visible only in partially masked form. Identified victims span Germany and the United States - a German law firm, a German corporate group, a New York hotel group, and a Virginia municipal government - indicating opportunistic, multi-sector targeting across two regions. The very low publication rate may reflect small affiliate capacity, selective targeting, or victims resolving incidents without being listed, so an idle leak site should not be read as inactivity. No widely reported vendor research, law-enforcement advisories, or blockchain-analytics reporting yet ties the group to specific operators, exploited vulnerabilities, or ransom-payment figures.
- Data-theft extortion with public leak-site victim listings (double-extortion pattern)
- Targets organizations in both the United States and Germany
- Victim mix spans municipal government, legal, hospitality, and industrial/corporate targets, indicating opportunistic rather than single-vertical selection
- Very low publication volume (4 tracked listings in 90 days; none since 2026-06-18)
- Initial access techniques, malware tooling, and exploited vulnerabilities: unknown (no public technical reporting)
suffolkva.us - City of Suffolk, Virginia (municipal government), Fitzpatrickhotels.com - Fitzpatrick Hotels (New York City hotel group), Dinnebiergruppe.de - Dinnebier Gruppe (German corporate group), ra-vogeler.de - German law firm ('RA' indicates Rechtsanwaltskanzlei)
No public figure.
Leak-site victims151 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| KVFCU.ORG | · Aug 24, 2023 | — |
In the newsAll →
No articles mention this group yet.