rook
First seen December 7, 2021Active9 claimed victims
The claims below are reproduced as posted by rook on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
According to PCrisk, Rook is ransomware (an updated variant of Babuk) that prevents victims from accessing/opening files by encrypting them. It also modifies filenames and creates a text file/ransom note (HowToRestoreYourFiles.txt). Rook renames files by appending the .Rook extension. For example, it renames 1.jpg to 1.jpg.Rook, 2.jpg to 2.jpg.Rook.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Abdi ibrahim | January 8, 2022 | ransomware_live | — |
| DENSO | December 28, 2021 | ransomware_live | — |
| Evalueserve | December 28, 2021 | ransomware_live | — |
| Data breach summary | December 26, 2021 | ransomware_live | — |
| KMG Prestige, Inc. (Data will be given tomorrow) | December 18, 2021 | ransomware_live | — |
| Rossell Techsys(Data will be given tomorrow) | December 18, 2021 | ransomware_live | — |
| Rossell Techsys | December 14, 2021 | ransomware_live | — |
| Rosendahl Design Group | December 14, 2021 | ransomware_live | — |
| KMG Prestige, Inc. | December 7, 2021 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).