Cloak ransomware, first detected as a variant around December 2020, established itself as a distinct threat group with public operations and a leak site appearing in August 2023, primarily functioning as a ransomware-as-a-service (RaaS) model. While its precise origins remain elusive, the group extensively uses Initial Access Brokers (IABs) operating on Russian underground forums, suggesting a possible nexus with Eastern European cybercriminal ecosystems. The group's core motivation is financial gain, which they pursue through aggressive double extortion tactics. Cloak distinguishes itself through its technical approach, employing virtual hard disks (VHDs) for payload delivery to circumvent antivirus detection and using the HC-128 algorithm with intermittent encryption for rapid data compromise. A defining characteristic is their exceptionally high ransom payment rate, estimated between 91% and 96%, largely due to intense pressure tactics, including the public release of sensitive exfi

Actores similares

cloakransomware · 166lockbit3ransomware · 2016qilinransomware · 1933akiraransomware · 1524playransomware · 1268clopransomware · 1254lockbit2ransomware · 1002ransomhubransomware · 842incransomransomware · 832alphvransomware · 731