Cloak is a financially motivated ransomware group that emerged in late 2022, distinguishing itself through an aggressive, multi-faceted extortion model. The group became publicly prominent with major campaigns starting in mid-2023. While its origins remain unclear, Cloak is known to acquire initial access through Initial Access Brokers, often operating within Russian-speaking forums. Initially focusing on double extortion by encrypting data and threatening its public release, the group has evolved to employ triple extortion, incorporating Distributed Denial of Service (DDoS) attacks against uncooperative victims. Cloak is also recognized by the alias "GoodDay," and has been linked to the ARCrypter ransomware variant.

Paises afectados

Sectores atacados

URLs nuevas detectadas en IntelTracker