Threat Group Profile
cloak
● Active — last 30 days
Victim claims
4
First seen
Jun 2026
Last activity
18 Jun 2026
Tracked since
—
Group overview
Cloak is a ransomware-as-a-service operation active since late 2022, primarily targeting small-to-medium enterprises in Europe — especially Germany — across manufacturing, healthcare, education, and government sectors, with expansion into North American and Asian targets by 2025.
Preferred targets
Business Services · 1
Most targeted countries
DE · 1
