Loading malware…
Cloak is a ransomware group/malware family active since at least late 2022 and described as part of the ransomware-as-a-service ecosystem. Reporting in the provided content states that Cloak ransomware has expanded its presence since emerging in late 2022 and had targeted more than 130 victims by early 2025. It has been observed in ransomware tracking focused on industrial entities, including Dragos reporting incidents attributed to Cloak in late 2023. The malware is described as sharing infrastructure with Good Day (ARCrypter) and using Babuk source code. The content states that Cloak targets global industries. A specifically reported victim was Baltimore City Public Schools, where reporting linked a February 2025 breach affecting about 31,000 individuals to the Cloak ransomware group. High-confidence indicators in the content are limited to the malware/group names and aliases: Cloak, Good Day, ARCrypter, and Babuk source-code lineage.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware operation referenced as low-volume persistent activity in Q2 2025 (no additional detail provided).
Cloak is a RaaS group using code linked to Babuk, employing double extortion, advanced encryption, and anti-debugging. It targets a wide range of industries globally and shares infrastructure with Good Day/ARCrypter.
Ransomware group known for targeting organizations and exfiltrating sensitive data, with over 130 victims since late 2022.
Ransomware family mentioned as observed in Q3 2023 but not observed in Q4 2023.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.