Rook

Inactive

According to PCrisk, Rook is ransomware (an updated variant of Babuk) that prevents victims from accessing/opening files by encrypting them. It also modifies filenames and creates a text file/ransom note (HowToRestoreYourFiles.txt). Rook renames files by appending the .Rook extension. For example, it renames 1.jpg to 1.jpg.Rook, 2.jpg to 2.jpg.Rook.

9 Victims

Dec 7, 2021 First Discovered

Jan 8, 2022 Last Discovered

1757 Days Inactive

0% Infostealer

0/1 Sites Online

Known Locations (1)

We Are Rook!!!

gamol6n6p2p4c3ad7gxmx3ur7wwdwlywebo2azv3vv5qlmjmole2zbyd.onion

Intelligence

📄 1 Ransom Notes
View the actual ransom notes used by this group →

Victims (9)

Detailed victim list temporarily unavailable

This group has 9 victims. The victim list API is currently responding slowly for this dataset. Country, sector, and infostealer breakdowns are not available at this time. Basic stats (victim count, first/last seen) are shown above from a faster data source.