// THREAT ACTOR

CLOAK_

Active

CLOAK is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem — file encryption combined with the threat of stolen-data publication on a public leak site — and continues to post fresh victim claims as part of an ongoing extortion campaign.

For Ransomnews editorial coverage of CLOAK — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.

152 Victims tracked

1 / 39 Active mirrors

2023-08-24 First listing

2026-06-18 Most recent

Victims by year

2026 8
2025 43
2024 70
2023 31

Leak site mirrors

39 mirrors tracked, 1 currently reachable. These are criminal-infrastructure URLs — links are deliberately not provided.

cloak7jpvcb73rtx2ff7kaw2kholu7bdiivxpzbhlny4ybz75dpxckqd.onion 403 Forbidden snapshot · 2026-08-06 21:02
6mw4yczxeqoiq7rgwnpi75qxsjd5jykuutpatflybodwlckoarhfdlid.onion snapshot · 2024-12-09 20:20
7puvv4qtcrigzbxshqibkpibzbmrs6thb7s6uf3tisqfp3t2ddpp66id.onion snapshot · 2024-12-18 10:08
jpef6snenchj3rxgugsozky3i34q66vmcoqy7neyu37xxiwxrad5doid.onion snapshot · 2024-12-11 15:18
glrw7ip5gz2fv2njbiqfvg5uiwavllw5zuixko4yrpj5hta7fjwqpjqd.onion 403 Forbidden snapshot · 2026-03-19 12:28
vicjwr6abknvcfjomocyb3koloidahc3hidwt5sq2ytwk7yepwfzlsid.onion 403 Forbidden snapshot · 2026-03-19 12:08
puzhh5aykks65qneqantprbqjt6k5bnigmwqwv6yvkxvkfu4ivva5mid.onion 403 Forbidden snapshot · 2026-03-19 13:16
piatupks5hai3oafo66xlj2eg2fbzjqy2j7gy3nyhqmnthlrwvrsolad.onion 403 Forbidden snapshot · 2026-03-19 13:04
necnstpnzuaovjocmiuv7ned7bstczit3kkvotqxl53xo5rfohndlvid.onion 403 Forbidden snapshot · 2026-03-19 13:03
ey2eak3vq5zbeu4s56m25mm4kvszy2is7gyjs6tsfzmhptbyijkzn2yd.onion 403 Forbidden snapshot · 2026-03-19 12:07
b53cqorlo7uftd3ymxguwnn7rfoz54ryoojjqxowdsaw2bahvuppntyd.onion 403 Forbidden snapshot · 2026-03-19 13:11
l3bbtg2p2gp2x43e2nngzkf7ab52k4mef3saowrl6m5notkts7p2vfyd.onion 403 Forbidden snapshot · 2026-03-19 12:28
vsdp5gqwrunytxw4f6dbxznux66aaewlwyenw3rantba4lwyzbckgfid.onion 403 Forbidden snapshot · 2026-03-19 12:29
a6gq22ngckken4xksz5ytl66sqeylh45ktke5pnbzfdksw5sfum5lvqd.onion 403 Forbidden snapshot · 2026-03-19 12:23
nbfxtlikrnicuht5yvvhlujpnh3spzjmek6eujeyck2ws34yytxjdhyd.onion 403 Forbidden snapshot · 2026-03-19 13:07
ziburuf5kh4phq5i6nmukpke7uruflhlvfexfmjwiwgghapz6ug3ajyd.onion 403 Forbidden snapshot · 2026-03-19 12:19
am3mzzguimx45wxywpukvwf3gobt3r4bidxzntjpsmqqge4s3vi2vvid.onion 403 Forbidden snapshot · 2026-03-19 13:00
occwme3xtlnzk3nlhn5ewsgodswrp6pysmmk7kcxqgj4hyiwkhoqcuyd.onion 403 Forbidden snapshot · 2026-03-19 13:03
qyywpuxysuur4exynwwwhu6nbd2f5vpj3h4tjbltfhwd4blamd4fppqd.onion 403 Forbidden snapshot · 2026-03-19 12:03
hsn2e745m36crxj2gmnrp432vbsyarhwvq3fgcyus345dp3oqlrltuad.onion 403 Forbidden snapshot · 2026-03-19 12:28
pbbeck4xcy3jzbu6lv5db3c5n3n44wngmpb5jj3yo4px32mlznziwbid.onion 403 Forbidden snapshot · 2026-03-19 13:02
hmxt5u75kj5qxqjqhckgaoda6zndgxcazleersyioat4iuq3ldgmkcid.onion 403 Forbidden snapshot · 2026-03-19 07:01
cii64fki62v2mudocjvgarzlmnpqrfp6xb7korapmdd7qmjpnccgduyd.onion 403 Forbidden snapshot · 2026-03-19 12:15
jrmayo7rvsx6sbv36djpdge6iwuem67dhccpctera2ykmqr6kplhayad.onion 403 Forbidden snapshot · 2026-03-19 13:02
ljrswxeei4isir3s5i7xmlzpx6sabmkgd7mvjrimcqwu7rqpn7bdjfad.onion 403 Forbidden snapshot · 2026-03-19 08:10
qixf7fqw237ikunw4ey22jsc4deltducf6zn4mq4ldyqab3ij3gehlyd.onion 403 Forbidden snapshot · 2026-03-19 13:02
ztqugnw4upfmd6mu3l6sdz2mfvzxzouhwgqqowyjeedgsmz733dqq2ad.onion 403 Forbidden snapshot · 2026-03-19 12:11
u66kitj46wmr5onijbbkg7cq45crcs66c563kyqy6klxm5c2nz42ujid.onion 403 Forbidden snapshot · 2026-03-19 12:04
e7gxrudyx2o733zlernyqqv623wyky5teor5xhnnx2g6dt4vf6jwn2yd.onion 403 Forbidden snapshot · 2026-03-19 13:14
qx2b2on5phkj4jczfpzfkb5cuhxn7wfqbgdu27pmxyzamoim3jqff6qd.onion 403 Forbidden snapshot · 2026-03-19 13:00

Recent victims

The 50 most recent victims claimed by CLOAK. Total in the index: 152.

Date listed	Victim	Description
2026-06-18	ra-vogeler.de	Country: germany \| Size: 1.1TB \| Private \| Views: 1
2026-06-16	ra-*******e	Country: *** \| Size: 1.1TB \| Private \| Views: 1
2026-06-16	d**********e	Country: *** \| Size: 359GB \| Private \| Views: 0
2026-06-16	W****S*****D	Country: *** \| Size: 102GB \| Private \| Views: 0
2026-02-24	suffolkva.us
2026-02-24	**el-p***.de
2026-02-19	Dinnebiergruppe.de
2026-02-03	***nei***pe.de
2025-12-30	Fitzpatrickhotels.com
2025-12-19	**patrh**s.com
2025-12-19	***l***.us
2025-11-18	Con*******.com
2025-11-18	**e-det.de
2025-10-16	*****.com
2025-10-16	L********den.com
2025-09-07	TuftsMedicine
2025-08-09	Wstg-steuerberater.de
2025-08-09	Tu*******ne
2025-08-09	Go********l
2025-08-09	*********.bh
2025-08-09	*******roup.ro
2025-07-07	Nos********om.br
2025-07-07	Ws*******.de
2025-06-27	Pensions.gov.lk
2025-06-06	Productionsaw.com	Country: USA Views: 164
2025-05-06	**********li.com
2025-04-18	Bosshard-farben.ch
2025-04-18	Pe*************.lk
2025-04-18	Orl***********.com
2025-04-18	pea**********.uk
2025-04-18	Pc***********.org
2025-03-20	Oag.state.va.us
2025-03-20	Wr-recht.de
2025-03-20	Baltimorecityschools
2025-03-20	Fi***************.pa
2025-03-20	St***********.nl
2025-02-25	ba**********.org
2025-02-20	Waggonereng.com
2025-02-20	op*********.eu
2025-02-20	wr********.de
2025-02-20	pen********.de
2025-02-20	oa*************.us
2025-02-03	Ad***********.ca
2025-01-30	Centromedicoenova	Country: Spain Views: 69 View more /enova Public
2025-01-29	Premierautocredit.com	Country: USA Views: 53 View more /pac Public 156GB
2025-01-28	Kaisersbach.de	Country: germany Views: 106 View more /kaiser Public
2025-01-28	Neovita.de	Country: germany Views: 88 View more /neovita Public 227GB
2025-01-23	Bwfg.at
2025-01-21	pre*************.com
2025-01-21	Wa**********.com

← Back to Ransomtracker

Statistics on this page are computed by Ransomnews from a live leak-site monitoring feed. Numbers update every ten minutes. Operator-written victim descriptions are truncated and shown in snippet form only. Source data: RansomLook (CC BY 4.0), aggregated and adapted by Ransomnews.