Latest Research on INC and The Gentlemen Ransomware: Exposed AI Infrastructure
cloak Ransomware Group
Ransomware group profile
Description
Cloak is a sophisticated ransomware group that emerged in early 2022, notorious for its stealth and advanced evasion methods. Primarily targeting small to medium-sized businesses, they leverage custom malware and zero-day vulnerabilities to conduct their operations, often employing a multi-faceted extortion strategy. Their tactics include double and triple extortion methods, where they threaten data leaks and DDoS attacks on victims who refuse to pay.
Key insights
- •Utilizes zero-day vulnerabilities and custom malware for infiltration and data encryption.
- •Employs spear-phishing for initial access, often using malicious attachments.
- •Known for multi-layered extortion tactics, combining data encryption, theft, and threats of public release.
- •Targets various sectors, notably healthcare and finance, with high payment rates from victims.
- •Increasingly leveraging initial access brokers to penetrate networks of high-value targets.
- •Shifts towards 'triple extortion' by including DDoS attacks against non-compliant victims.
Threat Level & Status Breakdown
For cloak · Based on incidents in selected period
Status Breakdown
Recent activity
Monthly attack count for cloak in the selected period
Intelligence
IOCs, YARA/Sigma rules, and related families for cloak
- 3928c5874249cc71b2d88e5c0c00989ac394238747bb7638897fc210531b4aab
- 7eec7d07587112777016e5742c0d002d7e64a3e1fe7bde82fed8f65e3663456a
- e1c371c7c39c16d208bcbaa5b5d0714df696e6ef68b95a880673a904527c8b96
- 75612233d32768186d0557dd39abbbd3284a2a29
- 07d22561a65a88d67f6890755e6e7742
- d0a63e059ed2c921c37c83246cdf4de0c8bc462b7c1d4b4ecd23a24196be7dd7
- 1e074d9dca6ef0edd24afb2d13ca4429def5fc5486cd4170c989ef60efd0bbb0
- e502b8d617a2cd9bfa41762282a0ff81
- 3403b92056d7645acfb7236824cc58b15e4d5395
- 77962a384d251f0aa8e3008a88f206d6cb1f7401c759c4614e3bfe865e3e985c
- e06520c65bf27d9110d68ecc0de0e0824c3a99be080ead1a5b5be8fd2a26d12d
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for cloak
T1486
T1486
T1490
T1490
T1078
T1078
T1059
T1059
T1547
T1547
T1021
T1021
T1562
T1562
T1021.001
T1021.001
T1090
T1090
T1003
T1003
T1105
T1105
T1041
T1041
Victims(5)
| Company | Country | Status | Discovered | |
|---|---|---|---|---|
| mediporta.ch | Switzerland | Claimed | 3 days ago | |
| Vogeler Rechtsanwälte | Germany | Claimed | 4 months ago | |
| suffolkva.us | United States | Claimed | 8 months ago | |
| Dinnebier Gruppe | Germany | Claimed | 8 months ago | |
| Fitzpatrick Hotel Group | United States | Claimed | 10 months ago |
Affected countries(37)
Countries where this group has been reported to target or leak victims.