Cloak is a ransomware-as-a-service group targeting European SMEs since late 2022.
Cloak is a ransomware-as-a-service group active since late 2022, primarily targeting small-to-medium enterprises in Europe. The group focuses on manufacturing, healthcare, education, government sectors, and Professional Services in Germany. Key TTPs include ransomware deployment, double extortion via data exfiltration, and unknown C2 infrastructure. Defenders should prioritize strong email phishing protections, network segmentation, and regular backup integrity checks.
Cloak is a ransomware-as-a-service operation active since late 2022, primarily targeting small-to-medium enterprises in Europe — especially Germany — across manufacturing, healthcare, education, and government sectors, with expansion into North American and Asian targets by 2025.
Cloak primarily targets manufacturing, healthcare, education, and government sectors in Germany.
Defenders should prioritize strong email phishing protections, network segmentation, and regular backup integrity checks.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.