Threat Group Profile
cloak
Dormant / historical
Victim claims
4
First seen
Jun 2026
Last activity
18 Jun 2026
Tracked since
Aug 2023
Group overview
Cloak is a ransomware-as-a-service operation active since late 2022, primarily targeting small-to-medium enterprises in Europe — especially Germany — across manufacturing, healthcare, education, and government sectors, with expansion into North American and Asian targets by 2025.
Preferred targets
Business Services · 1
Most targeted countries
DE · 1