Cloak

Active
Cloak is a ransomware-as-a-service operation active since late 2022, primarily targeting small-to-medium enterprises in Europe — especially Germany — across manufacturing, healthcare, education, and government sectors, with expansion into North American and Asian targets by 2025.
166 Victims
Aug 24, 2023 First Discovered
Jun 18, 2026 Last Discovered
90 Days Inactive
0% Infostealer
1/1 Sites Online
Known Locations (1)
403 Forbidden
cloak7jpvcb73rtx2ff7kaw2kholu7bdiivxpzbhlny4ybz75dpxckqd.onion
Intelligence
Victims (166)

Detailed victim list temporarily unavailable

This group has 166 victims. The victim list API is currently responding slowly for this dataset. Country, sector, and infostealer breakdowns are not available at this time. Basic stats (victim count, first/last seen) are shown above from a faster data source.