Cloak ransomware

Who Cloak is

Cloak is a ransomware-as-a-service operation active since late 2022, primarily targeting small-to-medium enterprises in Europe — especially Germany — across manufacturing, healthcare, education, and government sectors, with expansion into North American and Asian targets by 2025.

Recorded activity

Disclosures attributed to Cloak in this database run from January 2024 to October 2026, totalling 134 victims — 0.6% of everything tracked here. Cloak has listed victims in 23 countries in this database, most often United States, followed by Germany and United Kingdom. The sectors appearing most in its listings are Business Services, Technology, Healthcare.

Indicators of compromise

• 31c6032e6cfa6c514c0b0b30fe75c66e
• [email protected]

Showing a sample of 1 MD5, 1 EMAIL on file. Hashes and network indicators published for Cloak. Leak-site addresses are deliberately excluded. Indicators age quickly — treat a match as a starting point for investigation, and an absence of matches as no assurance.

YARA detection rules

/*
Cloak ransomware (ARCrypter-based)
*/

rule Cloak_Ransomnote
{
    meta:
        author = "ransomware.live"
        family = "ransomware.cloak"
        description = "Detects Cloak ransomware ransom note"
        date = "2026-05-04"
        severity = 7
        score = 70

    strings:
        $s1 = "Cloak" ascii nocase
        $s2 = "CLOAK" ascii
        $s3 = "cloak.onion" ascii nocase
        $s4 = "cloakteam" ascii nocase

    condition:
        any of them
}

Community-contributed rules for Cloak, reproduced as published. Test them against your own corpus before relying on them: rule quality and false-positive behaviour vary by author.