cloak
First seen August 24, 2023Active168 claimed victims
The claims below are reproduced as posted by cloak on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Cloak is a ransomware-as-a-service operation active since late 2022, primarily targeting small-to-medium enterprises in Europe — especially Germany — across manufacturing, healthcare, education, and government sectors, with expansion into North American and Asian targets by 2025.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| P********.pl | June 30, 2024 | ransomware_live | — |
| Ruland-viersen.de | June 27, 2024 | ransomware_live | — |
| Longviewbridge.com | June 27, 2024 | ransomware_live | — |
| ab*******.org | June 14, 2024 | ransomware_live | — |
| Mundocar.eu | June 14, 2024 | ransomware_live | — |
| lo***********.com | June 7, 2024 | ransomware_live | — |
| Rul**********.de | May 21, 2024 | ransomware_live | — |
| Baeckerei-raddatz.de | May 16, 2024 | ransomware_live | — |
| bae************.de | May 4, 2024 | ransomware_live | — |
| cli*********.com | May 4, 2024 | ransomware_live | — |
| B*****.hu | April 29, 2024 | ransomware_live | — |
| Ce***.com | April 27, 2024 | ransomware_live | — |
| Sev********.com | April 14, 2024 | ransomware_live | — |
| Theharriscenter.org | April 11, 2024 | ransomware_live | — |
| Wencor.com | April 11, 2024 | ransomware_live | — |
| Cv*****.com | April 8, 2024 | ransomware_live | — |
| Mu*****.eu | April 8, 2024 | ransomware_live | — |
| Speditionweise.de | April 8, 2024 | ransomware_live | — |
| Equatorial Energia | March 24, 2024 | ransomware_live | — |
| Gascontec.com | March 24, 2024 | ransomware_live | — |
| Vhs-vaterstetten.de | March 24, 2024 | ransomware_live | — |
| ****************** | March 18, 2024 | ransomware_live | — |
| Hu********.ca | March 12, 2024 | ransomware_live | — |
| Ponoka.ca | March 3, 2024 | ransomware_live | — |
| Po****.ca | February 23, 2024 | ransomware_live | — |
| Sped**********.de | February 20, 2024 | ransomware_live | — |
| The************.org | February 20, 2024 | ransomware_live | — |
| we****.com | February 20, 2024 | ransomware_live | — |
| ga*******.com | February 12, 2024 | ransomware_live | — |
| bv*********.com | February 12, 2024 | ransomware_live | — |
| Forgepresion.com | February 12, 2024 | ransomware_live | — |
| vh********en.de | February 1, 2024 | ransomware_live | — |
| For**********.com | January 24, 2024 | ransomware_live | — |
| Maas911.com | January 6, 2024 | ransomware_live | — |
| Ma******.com | December 27, 2023 | ransomware_live | — |
| M********org | December 27, 2023 | ransomware_live | — |
| Ga***********.com | December 8, 2023 | ransomware_live | — |
| Gaido-fintzen.com | December 8, 2023 | ransomware_live | — |
| carranza.on.ca | December 1, 2023 | ransomware_live | — |
| Bankofceylon.co.uk | December 1, 2023 | ransomware_live | — |
| Thenewtrongroup.com | December 1, 2023 | ransomware_live | — |
| euro2000-spa.it | December 1, 2023 | ransomware_live | — |
| skncustoms.com | December 1, 2023 | ransomware_live | — |
| farwickgrote.de | December 1, 2023 | ransomware_live | — |
| KVFCU.ORG | August 24, 2023 | ransomware_live | — |
| Sonabhy.bf | August 24, 2023 | ransomware_live | — |
| Notaires.fr | August 24, 2023 | ransomware_live | — |
| ALEZZELPOWER.com | August 24, 2023 | ransomware_live | — |
| flamewarestudios.com | August 24, 2023 | ransomware_live | — |
| gsh-cargo.com | August 24, 2023 | ransomware_live | — |
| still95.it | August 24, 2023 | ransomware_live | — |
| INCOBEC | August 24, 2023 | ransomware_live | — |
| imtmro.com | August 24, 2023 | ransomware_live | — |
| Sbs-Berlin | August 24, 2023 | ransomware_live | — |
| first-resources-ltd | August 24, 2023 | ransomware_live | — |
| binhamoodah.ae | August 24, 2023 | ransomware_live | — |
| Nicer technology | August 24, 2023 | ransomware_live | — |
| ihopmexico.com | August 24, 2023 | ransomware_live | — |
| stshcpa.com.tw | August 24, 2023 | ransomware_live | — |
| gruppomoba.com | August 24, 2023 | ransomware_live | — |
| mps-24.com | August 24, 2023 | ransomware_live | — |
| surapon.com | August 24, 2023 | ransomware_live | — |
| GRIDINSTALLERS.com | August 24, 2023 | ransomware_live | — |
| werk33.com | August 24, 2023 | ransomware_live | — |
| lusis-avocats.com | August 24, 2023 | ransomware_live | — |
| BONI-PASSAU.DE | August 24, 2023 | ransomware_live | — |
| Sportlab-srl | August 24, 2023 | ransomware_live | — |
| Arus-gmbh | August 24, 2023 | ransomware_live | — |
← NewerPage 2 of 2
Claim data from ransomware.live and RansomLook (CC BY 4.0).