THREAT ACTOR
CLOAK_
DormantCLOAK is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of CLOAK, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
Victims by year
- 2026 8
- 2025 43
- 2024 70
- 2023 31
Leak site mirrors
39 mirrors tracked, 0 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
cloak7jpvcb73rtx2ff7kaw2kholu7bdiivxpzbhlny4ybz75dpxckqd.onion403 Forbidden snapshot · 2026-09-23 00:11 -
6mw4yczxeqoiq7rgwnpi75qxsjd5jykuutpatflybodwlckoarhfdlid.onionsnapshot · 2024-12-09 20:20 -
7puvv4qtcrigzbxshqibkpibzbmrs6thb7s6uf3tisqfp3t2ddpp66id.onionsnapshot · 2024-12-18 10:08 -
jpef6snenchj3rxgugsozky3i34q66vmcoqy7neyu37xxiwxrad5doid.onionsnapshot · 2024-12-11 15:18 -
glrw7ip5gz2fv2njbiqfvg5uiwavllw5zuixko4yrpj5hta7fjwqpjqd.onion403 Forbidden snapshot · 2026-03-19 12:28 -
vicjwr6abknvcfjomocyb3koloidahc3hidwt5sq2ytwk7yepwfzlsid.onion403 Forbidden snapshot · 2026-03-19 12:08 -
puzhh5aykks65qneqantprbqjt6k5bnigmwqwv6yvkxvkfu4ivva5mid.onion403 Forbidden snapshot · 2026-03-19 13:16 -
piatupks5hai3oafo66xlj2eg2fbzjqy2j7gy3nyhqmnthlrwvrsolad.onion403 Forbidden snapshot · 2026-03-19 13:04 -
necnstpnzuaovjocmiuv7ned7bstczit3kkvotqxl53xo5rfohndlvid.onion403 Forbidden snapshot · 2026-03-19 13:03 -
ey2eak3vq5zbeu4s56m25mm4kvszy2is7gyjs6tsfzmhptbyijkzn2yd.onion403 Forbidden snapshot · 2026-03-19 12:07 -
b53cqorlo7uftd3ymxguwnn7rfoz54ryoojjqxowdsaw2bahvuppntyd.onion403 Forbidden snapshot · 2026-03-19 13:11 -
l3bbtg2p2gp2x43e2nngzkf7ab52k4mef3saowrl6m5notkts7p2vfyd.onion403 Forbidden snapshot · 2026-03-19 12:28 -
vsdp5gqwrunytxw4f6dbxznux66aaewlwyenw3rantba4lwyzbckgfid.onion403 Forbidden snapshot · 2026-03-19 12:29 -
a6gq22ngckken4xksz5ytl66sqeylh45ktke5pnbzfdksw5sfum5lvqd.onion403 Forbidden snapshot · 2026-03-19 12:23 -
nbfxtlikrnicuht5yvvhlujpnh3spzjmek6eujeyck2ws34yytxjdhyd.onion403 Forbidden snapshot · 2026-03-19 13:07 -
ziburuf5kh4phq5i6nmukpke7uruflhlvfexfmjwiwgghapz6ug3ajyd.onion403 Forbidden snapshot · 2026-03-19 12:19 -
am3mzzguimx45wxywpukvwf3gobt3r4bidxzntjpsmqqge4s3vi2vvid.onion403 Forbidden snapshot · 2026-03-19 13:00 -
occwme3xtlnzk3nlhn5ewsgodswrp6pysmmk7kcxqgj4hyiwkhoqcuyd.onion403 Forbidden snapshot · 2026-03-19 13:03 -
qyywpuxysuur4exynwwwhu6nbd2f5vpj3h4tjbltfhwd4blamd4fppqd.onion403 Forbidden snapshot · 2026-03-19 12:03 -
hsn2e745m36crxj2gmnrp432vbsyarhwvq3fgcyus345dp3oqlrltuad.onion403 Forbidden snapshot · 2026-03-19 12:28 -
pbbeck4xcy3jzbu6lv5db3c5n3n44wngmpb5jj3yo4px32mlznziwbid.onion403 Forbidden snapshot · 2026-03-19 13:02 -
hmxt5u75kj5qxqjqhckgaoda6zndgxcazleersyioat4iuq3ldgmkcid.onion403 Forbidden snapshot · 2026-03-19 07:01 -
cii64fki62v2mudocjvgarzlmnpqrfp6xb7korapmdd7qmjpnccgduyd.onion403 Forbidden snapshot · 2026-03-19 12:15 -
jrmayo7rvsx6sbv36djpdge6iwuem67dhccpctera2ykmqr6kplhayad.onion403 Forbidden snapshot · 2026-03-19 13:02 -
ljrswxeei4isir3s5i7xmlzpx6sabmkgd7mvjrimcqwu7rqpn7bdjfad.onion403 Forbidden snapshot · 2026-03-19 08:10 -
qixf7fqw237ikunw4ey22jsc4deltducf6zn4mq4ldyqab3ij3gehlyd.onion403 Forbidden snapshot · 2026-03-19 13:02 -
ztqugnw4upfmd6mu3l6sdz2mfvzxzouhwgqqowyjeedgsmz733dqq2ad.onion403 Forbidden snapshot · 2026-03-19 12:11 -
u66kitj46wmr5onijbbkg7cq45crcs66c563kyqy6klxm5c2nz42ujid.onion403 Forbidden snapshot · 2026-03-19 12:04 -
e7gxrudyx2o733zlernyqqv623wyky5teor5xhnnx2g6dt4vf6jwn2yd.onion403 Forbidden snapshot · 2026-03-19 13:14 -
qx2b2on5phkj4jczfpzfkb5cuhxn7wfqbgdu27pmxyzamoim3jqff6qd.onion403 Forbidden snapshot · 2026-03-19 13:00
Recent victims
The 50 most recent victims claimed by CLOAK. Total in the index: 152.
| Date listed | Victim | Description |
|---|---|---|
| 2026-06-18 | ra-vogeler.de | Country: germany | Size: 1.1TB | Private | Views: 1 |
| 2026-06-16 | ra-*******e | Country: *** | Size: 1.1TB | Private | Views: 1 |
| 2026-06-16 | d**********e | Country: *** | Size: 359GB | Private | Views: 0 |
| 2026-06-16 | W******S*******D | Country: *** | Size: 102GB | Private | Views: 0 |
| 2026-02-24 | suffolkva.us | |
| 2026-02-24 | ****el-p*****.de | |
| 2026-02-19 | Dinnebiergruppe.de | |
| 2026-02-03 | ****ne*i***pe.de | |
| 2025-12-30 | Fitzpatrickhotels.com | |
| 2025-12-19 | ****patr**h**s.com | |
| 2025-12-19 | *****l*****.us | |
| 2025-11-18 | Con*******.com | |
| 2025-11-18 | ****e-det**.de | |
| 2025-10-16 | *****.com | |
| 2025-10-16 | L********den.com | |
| 2025-09-07 | TuftsMedicine | |
| 2025-08-09 | Wstg-steuerberater.de | |
| 2025-08-09 | Tu*******ne | |
| 2025-08-09 | Go********l | |
| 2025-08-09 | *********.bh | |
| 2025-08-09 | *******roup.ro | |
| 2025-07-07 | Nos********om.br | |
| 2025-07-07 | Ws*******.de | |
| 2025-06-27 | Pensions.gov.lk | |
| 2025-06-06 | Productionsaw.com | Country: USA Views: 164 |
| 2025-05-06 | **********li.com | |
| 2025-04-18 | Bosshard-farben.ch | |
| 2025-04-18 | Pe*************.lk | |
| 2025-04-18 | Orl***********.com | |
| 2025-04-18 | pea**********.uk | |
| 2025-04-18 | Pc***********.org | |
| 2025-03-20 | Oag.state.va.us | |
| 2025-03-20 | Wr-recht.de | |
| 2025-03-20 | Baltimorecityschools | |
| 2025-03-20 | Fi***************.pa | |
| 2025-03-20 | St***********.nl | |
| 2025-02-25 | ba**********.org | |
| 2025-02-20 | Waggonereng.com | |
| 2025-02-20 | op*********.eu | |
| 2025-02-20 | wr********.de | |
| 2025-02-20 | pen********.de | |
| 2025-02-20 | oa*************.us | |
| 2025-02-03 | Ad***********.ca | |
| 2025-01-30 | Centromedicoenova | Country: Spain Views: 69 View more /enova Public |
| 2025-01-29 | Premierautocredit.com | Country: USA Views: 53 View more /pac Public 156GB |
| 2025-01-28 | Kaisersbach.de | Country: germany Views: 106 View more /kaiser Public |
| 2025-01-28 | Neovita.de | Country: germany Views: 88 View more /neovita Public 227GB |
| 2025-01-23 | Bwfg.at | |
| 2025-01-21 | pre*************.com | |
| 2025-01-21 | Wa**********.com |
CONFIRMED ATTACKS
Cloak confirmed attacks: 20 verified incidents
Ransomnews has verified 20 Cloak incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from June 2023 to February 2026. United States accounts for 9 of them (45%), with victims recorded in 8 countries in total. The most affected sector is government, at 5 confirmed victims. A ransom payment was publicly confirmed in 0 cases and publicly refused in 1; the outcome is unrecorded in the remaining 19. Where a figure was disclosed (5 cases), these incidents account for 234,276 exposed records.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Cloak incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| February 2026 | City of Suffolk | Government | Virginia, United States | 157,725 | Unknown | Source |
| January 2026 | Dinnebier Gruppe | Retail | Wittenberge, Germany | — | Unknown | Source |
| April 2025 | Department of Pensions | Government | Colombo, Sri Lanka | — | Unknown | Source |
| March 2025 | Bosshard-Farben AG | Manufacturing | Rümlang, Switzerland | — | Unknown | Source |
| February 2025 | Baltimore City Public Schools | Education | Maryland, United States | 20,665 | No | Source |
| February 2025 | Attorney General of Virginia | Government | Virginia, United States | — | Unknown | Source |
| January 2025 | Premier Auto Credit | Finance | California, United States | — | Unknown | Source |
| December 2024 | Gemeinde Kaisersbach | Government | Kaisersbach, Germany | — | Unknown | Source |
| November 2024 | Zentrum für Orthopädie und Neurochirurgie | Healthcare | Hof, Germany | — | Unknown | Source |
| September 2024 | Wertachkliniken | Healthcare | Bobingen, Germany | — | Unknown | Source |
| August 2024 | St. James Place of Baton Rouge | Other | Louisiana, United States | — | Unknown | Source |
| July 2024 | Boligforeningen VIBO | Other | Copenhagen, Denmark | — | Unknown | Source |
| June 2024 | Dunlop Aircraft Tyres Ltd | Manufacturing | Birmingham, United Kingdom | — | Unknown | Source |
| June 2024 | Abilene Independent School District | Education | Texas, United States | 16,181 | Unknown | Source |
| February 2024 | Town of Ponoka | Government | Ponoka, Canada | — | Unknown | Source |
| January 2024 | Volkshochschule Vaterstetten | Education | Vaterstetten, Germany | — | Unknown | Source |
| November 2023 | Wencor Group | Service | Georgia, United States | — | Unknown | Source |
| August 2023 | The Newtron Group LLC | Construction | Louisiana, United States | 39,608 | Unknown | Source |
| June 2023 | Moba Eurotubi | Manufacturing | Montorfano, Italy | — | Unknown | Source |
| June 2023 | KV Federal Credit Union | Finance | Maine, United States | 97 | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Cloak's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.