Ransomware Group intelligence

Cloak

Inactive

Track Cloak with 166 published victims and 1 known leak locations in a single intelligence view.

BREACH HOUSE ALERTS

Want an alert every time a new ransomware post is published?

Choose the feeds and the countries you care about — we email you when they move.

Victims 166 Known published victims in this dataset

First discovered 2023-08-24 Earliest victim discovery date

Last discovered 2026-06-18 Latest victim discovery date

Inactive since 120 days Days since the latest known victim

Top country United States 42 victims

Known locations 1 Leak or negotiation infrastructure tracked

Cloak is tracked by Breach House as a ransomware group with 166 published victims.

United States is currently the most targeted country in this dataset.

1 known leak locations are currently associated with this group.

166

Leaked 0 0.0%
Pending 166 100.0%
Deleted 0 0.0%

Top Countries

Distribution

Label	Type	Availability	Links
Leak location 1	Onion service	Up checked 4h ago	`cloak7jpvcb73rtx2ff7kaw2kholu7bdiivxpzbhlny4ybz75dpxckqd.onion`

Not identified 117
Communication / Marketing 20
Public Sector 9
Finance / Legal / Insurance 5
Services 4
Manufacturing / Engineering 2
IT 2
Energy 2
Construction / Real Estate 1
Hospitality / Food & Beverage / Tourism 1
Healthcare / Pharma 1
Education 1
Transportation / Travel / Logistics 1

Typical Attacks (10)

▼

MITRE ATT&CK does not currently catalogue Cloak, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.

T1059.001 PowerShell Execution

What they do: cloak uses PowerShell to execute malicious payloads and stage ransomware operations on compromised hosts.

What that means: Adversaries may abuse PowerShell commands and scripts for execution.
T1547.001 Registry Run Keys / Startup Folder PersistencePrivilege Escalation

What they do: cloak modifies registry run keys to ensure malware execution upon system reboot for persistence.

What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
T1685 Disable or Modify Tools Defense Impairment

What they do: cloak disables security tools such as antivirus software to prevent detection and hinder incident response.

What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
T1027.013 Encrypted/Encoded File Stealth

What they do: cloak encodes victim data with symmetric encryption keys before exfiltration to protect stolen information.

What that means: Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection.
T1070.004 File Deletion Stealth

What they do: cloak deletes Volume Shadow Copies and backup directories via system commands to eliminate recovery options.

What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
T1018 Remote System Discovery Discovery

What they do: cloak uses remote system discovery to map internal networks and identify high-value targets for encryption.

What that means: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.
T1049 System Network Connections Discovery Discovery

What they do: cloak queries system network connections to identify active services and potential lateral movement paths.

What that means: Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
T1135 Network Share Discovery Discovery

What they do: cloak performs network share discovery to identify accessible directories for lateral movement and data targeting.

What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
T1486 Data Encrypted for Impact Impact

What they do: cloak encrypts victim files using custom ransomware binaries to maximize impact and extortion leverage.

What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
T1490 Inhibit System Recovery Impact

What they do: cloak invokes system recovery inhibition commands to block automatic restoration from backups or snapshots.

What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.

Ransom Notes (3)

▼

The note this group leaves on a compromised machine. Click a filename to read it.

readme_for_unlock.txt txt · 2505 chars

!!! ATTENTION !!!

Your network is hacked and files are encrypted.
	Including the encrypted data we also downloaded other confidential information:
	Data of your employees, customers, partners, as well as accounting and
	other internal documentation of your company.

All data is stored until you will pay.
	After payment we will provide you the programs for decryption and we will delete your data.
	If you refuse to negotiate with us (for any reason) all your data will be put up for sale.

What you will face if your data gets on the black market:
	1) The personal information of your employees and customers may be used to obtain a loan or
		purchases in online stores.
	2) You may be sued by clients of your company for leaking information that was confidential.
	3) After other hackers obtain personal data about your employees, social engineering will be
		applied to your company and subsequent attacks will only intensify.
	4) Bank details and passports can be used to create bank accounts and online wallets through 
		which criminal money will be laundered.
	5) You will forever lose the reputation.
	6) You will be subject to huge fines from the government.
		You can learn more about liability for data loss here:
			https://en.wikipedia.org/wiki/General_Data_Protection_Regulation
			https://gdpr-info.eu/
	Courts, fines and the inability to use important files will lead you to huge losses.
	The consequences of this will be irreversible for you.
	Contacting the police will not save you from these consequences,
		but will only make your situation worse.

You can get out of this situation with minimal losses
	To do this you must strictly observe the following rules:
		DO NOT Modify, DO NOT rename, DO NOT copy, DO NOT move any files.
			Such actions may DAMAGE them and decryption will be impossible.
		DO NOT use any third party or public decryption software, it may also DAMAGE files.
		DO NOT Shutdown or Reboot the system this may DAMAGE files.
		DO NOT hire any third party negotiators (recovery/police, etc.)
		You need to contact us as soon as possible and start negotiations.

Instructions for contacting our team:
	Download & Install TOR browser: https://torproject.org
	For contact us via LIVE CHAT open our
	> Website:  http://47h4pwve4scndaneljfnxdhzoulgsyfzbgayyonbwztfz74gsdprz5qd.onion
	> Login:    [snip]
	> Password: [snip]
	If Tor is restricted in your area, use VPN
	If you have any problems with LIVE CHAT you can send a message here:
	> Email: [email protected]

View on RansomLook

readme_for_unlock_nov2024.txt txt · 2403 chars

!!! ATTENTION !!!

Your network is hacked and files are encrypted.
Including the encrypted data we also downloaded other confidential information:
Data of your employees, customers, partners, as well as accounting and
other internal documentation of your company.

All data is stored until you will pay.
After payment we will provide you the programs for decryption and we will delete your data.
If you refuse to negotiate with us (for any reason) all your data will be put up for sale.

What you will face if your data gets on the black market:
1) The personal information of your employees and customers may be used to obtain a loan or
purchases in online stores.
2) You may be sued by clients of your company for leaking information that was confidential.
3) After other hackers obtain personal data about your employees, social engineering will be
applied to your company and subsequent attacks will only intensify.
4) Bank details and passports can be used to create bank accounts and online wallets through
which criminal money will be laundered.
5) You will forever lose the reputation.
6) You will be subject to huge fines from the government.
You can learn more about liability for data loss here:
https://en.wikipedia.org/wiki/General_Data_Protection_Regulation
https://gdpr-info.eu/
Courts, fines and the inability to use important files will lead you to huge losses.
The consequences of this will be irreversible for you.
Contacting the police will not save you from these consequences,
but will only make your situation worse.

You can get out of this situation with minimal losses
To do this you must strictly observe the following rules:
DO NOT Modify, DO NOT rename, DO NOT copy, DO NOT move any files.
Such actions may DAMAGE them and decryption will be impossible.
DO NOT use any third party or public decryption software, it may also DAMAGE files.
DO NOT Shutdown or Reboot the system this may DAMAGE files.
DO NOT hire any third party negotiators (recovery/police, etc.)
You need to contact us as soon as possible and start negotiations.

Instructions for contacting our team:
Download & Install TOR browser: https://torproject.org
For contact us via LIVE CHAT open our
> Website: http://7puvv4qtcrigzbxshqibkpibzbmrs6thb7s6uf3tisqfp3t2ddpp66id.onion
> Login: [snip]
> Password: [snip]
If Tor is restricted in your area, use VPN

View on RansomLook

readme_for_unlock_oct2024.txt txt · 1721 chars

Urgent! Your files have been encrypted - act now to recover them!

Greetings,
We are a Ransomware Group, and we have successfully infiltrated your system and encrypted your valuable files.
We have the only working decryptor, which is the one way to restore your data.

Do not attempt to recover the files yourself or involve any third-party organizations, such as law enforcement or cybersecurity firms.
Any attempts to do so will result in the permanent deletion of your files without any chance of recovery.

To regain access to your files, you must follow these steps:
   Download & Install TOR browser: https://www.torproject.org/download/
   For contact us via LIVE CHAT open our
   > Website: http://6mw4yczxeqoiq7rgwnpi75qxsjd5jykuutpatflybodwlckoarhfdlid.onion
   > Login: [snip]
   > Password: [snip]
   > Secret Question: [snip]
   If Tor is restricted in your area, use VPN.   We offer a free trial decryption of two insignificant files (<5 MB) to demonstrate our capabilities and build trust.
   We will provide you with further instructions and the exact amount of ransom required to decrypt your files.
   Make the payment in Bitcoin to the provided wallet address.
   Once the payment is confirmed, we will send you the decryptor.

Please note that you have a limited time to act before the deadline expires.
After that, the decryptor will be destroyed, and your files will remain encrypted forever.
Do not ignore this message or attempt to deceive us.
We have already infiltrated your system, and we can easily detect any attempts to bypass our ransom demands.

Take this situation seriously and act quickly to recover your files.
Write to us in the chat to begin the process.

Sincerely, Ransomware Group

View on RansomLook

Ransom-note text from RansomLook, licensed CC BY 4.0.

Victims (166)

Search, filter and paginate the victim timeline for Cloak. Showing 1–100 of 166.

Type	Target	Discovered	Country	Business Category	Intel Link	Leak status
Ransomware	ra-vogeler.de id29987 View details	2026-06-18	Germany	Finance / Legal / Insurance	—	pending
Country: germany \| Size: 1.1TB \| Private \| Views: 1 ID 29987
Ransomware	ra-***e id29944 View details	2026-06-16		Manufacturing / Engineering	—	pending
Country: *** \| Size: 1.1TB \| Private \| Views: 1 ID 29944
Ransomware	d******e id29945 View details	2026-06-16		IT	—	pending
Country: *** \| Size: 359GB \| Private \| Views: 0 ID 29945
Ransomware	W**S***D id29946 View details	2026-06-16		Finance / Legal / Insurance	—	pending
Country: *** \| Size: 102GB \| Private \| Views: 0 ID 29946
Ransomware	suffolkva.us id26779 View details	2026-02-24	United States	Other	—	pending
[AI generated] N/A ID 26779
Ransomware	**el-p***.de id26778 View details	2026-02-24	Germany	Other	—	pending
No additional victim description available. ID 26778
Ransomware	Dinnebiergruppe.de id26657 View details	2026-02-19	Germany	Construction / Real Estate	—	pending
[AI generated] "Dinnebiergruppe.de" is a German company incorporated into the automobile industry. They are authorized dealers for major car brands including Mercedes-Benz, smart, Audi, Porsche, and Volkswagen Commercial Vehicles. The company offers a broad range of services including car sales, leasing, financing, insurance, and extensive car maintenance. Moreover, they are also involved in real estate management, hotel industry, and operate petrol stations. ID 26657
Ransomware	***nei***pe.de id26086 View details	2026-02-03		Other	—	pending
No additional victim description available. ID 26086
Ransomware	Fitzpatrickhotels.com id25221 View details	2025-12-30	United States	Hospitality / Food & Beverage / Tourism	—	pending
[AI generated] Fitzpatrick Hotels operates two boutique hotels in New York City, providing Irish-style hospitality to guests. Established in the late 20th century, the family-owned business primarily caters to those who value warmth, charm, and a touch of old-world elegance. Their hotels, Fitzpatrick Manhattan and Fitzpatrick Grand Central, boast a strategic location, iconic Irish pub-style restaurants, sophisticated amenities, and rooms. ID 25221
Ransomware	**patrh**s.com id24923 View details	2025-12-19		Other	—	pending
No additional victim description available. ID 24923
Ransomware	***l***.us id24922 View details	2025-12-19		Other	—	pending
No additional victim description available. ID 24922
Ransomware	Con***.com id23969 View details	2025-11-18		Other	—	pending
No additional victim description available. ID 23969
Ransomware	**e-det.de id23968 View details	2025-11-18		Other	—	pending
No additional victim description available. ID 23968
Ransomware	*****.com id23148 View details	2025-10-16		Other	—	pending
No additional victim description available. ID 23148
Ransomware	L****den.com id23147 View details	2025-10-16		Other	—	pending
No additional victim description available. ID 23147
Ransomware	TuftsMedicine id22164 View details	2025-09-07	United States	Healthcare / Pharma	—	pending
[AI generated] N/A ID 22164
Ransomware	Wstg-steuerberater.de id21636 View details	2025-08-09	Germany	Other	—	pending
Seit über dreißig Jahren betreuen Frank Hoffmann und Stephan Hofmann zuverlässig Mandanten an Rhein und Ruhr und aus dem Bergischen Land. ID 21636
Ransomware	Tu***ne id21635 View details	2025-08-09		Other	—	pending
No additional victim description available. ID 21635
Ransomware	Go****l id21634 View details	2025-08-09		Other	—	pending
No additional victim description available. ID 21634
Ransomware	*********.bh id21633 View details	2025-08-09	Bahrain	Other	—	pending
No additional victim description available. ID 21633
Ransomware	*******roup.ro id21632 View details	2025-08-09	Romania	Other	—	pending
No additional victim description available. ID 21632
Ransomware	Nos****om.br id21011 View details	2025-07-07	Brazil	Other	—	pending
No additional victim description available. ID 21011
Ransomware	Ws***.de id21010 View details	2025-07-07	Germany	Other	—	pending
No additional victim description available. ID 21010
Ransomware	Pensions.gov.lk id20854 View details	2025-06-27	Sri Lanka	Other	—	pending
[AI generated] N/A ID 20854
Ransomware	Productionsaw.com id20493 View details	2025-06-06	United States	Manufacturing / Engineering	—	pending
Country: USA Views: 161 ID 20493
Ransomware	**********li.com id19767 View details	2025-05-06		Other	—	pending
No additional victim description available. ID 19767
Ransomware	Bosshard-farben.ch id19248 View details	2025-04-18	Switzerland	Communication / Marketing	—	pending
[AI generated] "Bosshard-farben.ch" is a Swiss company specializing in the sale of floor and wall paints. In addition to interior and exterior paints, they offer lacquers, glazes, plasters, and other painting supplies. They also provide additional products for floor, wall and ceiling design. Renowned for their comprehensive selection, they cater to both professional painters and DIY enthusiasts. ID 19248
Ransomware	Pe*********.lk id19247 View details	2025-04-18	Sri Lanka	Other	—	pending
No additional victim description available. ID 19247
Ransomware	Orl*******.com id19246 View details	2025-04-18		Other	—	pending
No additional victim description available. ID 19246
Ransomware	pea******.uk id19245 View details	2025-04-18	United Kingdom	Other	—	pending
No additional victim description available. ID 19245
Ransomware	Pc*******.org id19244 View details	2025-04-18		Other	—	pending
No additional victim description available. ID 19244
Ransomware	Bosshard-Farben AG id18990 View details	2025-04-06	Switzerland	Communication / Marketing	—	pending
[IA generated] Swiss company specializing in the production of paints, varnishes, and glazes for building and wood protection, ID 18990
Ransomware	Oag.state.va.us id18550 View details	2025-03-20	United States	Public Sector	—	pending
[AI generated] N/A ID 18550
Ransomware	Wr-recht.de id18549 View details	2025-03-20	Germany	Finance / Legal / Insurance	—	pending
[AI generated] "Wr-recht.de" is a German legal advisory firm that specializes in matters of insolvency law, commercial law, and general civil law. The company caters to both private individuals and businesses, offering effective and efficient legal services. They possess extensive experience in guiding clients through legal proceedings, ensuring optimal client representation. ID 18549
Ransomware	Baltimorecityschools id18548 View details	2025-03-20	United States	Education	—	pending
[AI generated] Baltimore City Public Schools, also known as City Schools, is a public school district in Baltimore, Maryland, United States. It serves the youth of Baltimore and is committed to providing a comprehensive, high-quality education. The district includes elementary, middle, and high schools, and offers specialized programs and initiatives to support students' growth and development. ID 18548
Ransomware	Fi***********.pa id18547 View details	2025-03-20	Panama	Other	—	pending
No additional victim description available. ID 18547
Ransomware	St*******.nl id18546 View details	2025-03-20	Netherlands	Other	—	pending
No additional victim description available. ID 18546
Ransomware	ba******.org id17781 View details	2025-02-25		Other	—	pending
No additional victim description available. ID 17781
Ransomware	Waggonereng.com id17673 View details	2025-02-20	United States	Services	—	pending
[AI generated] Waggoner Engineering, founded in 1976, is a professional services firm with a focus on engineering, geospatial and consulting services. Their team of multidisciplinary professionals serve clients within sectors like government agencies, industrial organizations, and private sector clients. The key industries they work in include energy, environment, infrastructure, and technology. Their headquarters are in Jackson, Mississippi. ID 17673
Ransomware	op*****.eu id17672 View details	2025-02-20		Other	—	pending
No additional victim description available. ID 17672
Ransomware	wr****.de id17671 View details	2025-02-20	Germany	Other	—	pending
No additional victim description available. ID 17671
Ransomware	pen****.de id17670 View details	2025-02-20	Germany	Other	—	pending
No additional victim description available. ID 17670
Ransomware	oa*********.us id17669 View details	2025-02-20	United States	Other	—	pending
No additional victim description available. ID 17669
Ransomware	Ad*******.ca id17139 View details	2025-02-03	Canada	Other	—	pending
No additional victim description available. ID 17139
Ransomware	Centromedicoenova id17021 View details	2025-01-30	Spain	Public Sector	—	pending
Country: Spain Views: 69 View more /enova Public <100GB ID 17021
Ransomware	Premierautocredit.com id17001 View details	2025-01-29	United States	Finance / Legal / Insurance	—	pending
Country: USA Views: 53 View more /pac Public 156GB ID 17001
Ransomware	Kaisersbach.de id16953 View details	2025-01-28	Germany	Public Sector	—	pending
Country: germany Views: 106 View more /kaiser Public <100GB ID 16953
Ransomware	Neovita.de id16952 View details	2025-01-28	Germany	Public Sector	—	pending
Country: germany Views: 88 View more /neovita Public 227GB ID 16952
Ransomware	Bwfg.at id16783 View details	2025-01-23	Austria	Public Sector	—	pending
Bwfg.at Country: austria Views: 16 View more /bwfg Public 102GB ID 16783
Ransomware	pre*********.com id16742 View details	2025-01-21		Communication / Marketing	—	pending
Country: USA Views: 0 View more /hidden_113 Private 156GB ID 16742
Ransomware	Wa******.com id16741 View details	2025-01-21		Communication / Marketing	—	pending
Country: USA Views: 0 View more /hidden_114 Private ID 16741
Ransomware	ge***.com id16740 View details	2025-01-21		Communication / Marketing	—	pending
Country: Italy Views: 0 View more /hidden_115 Private 271GB ID 16740
Ransomware	Mai*******.de id16461 View details	2024-12-30	Germany	Communication / Marketing	—	pending
Mai***********.de Country: germany Views: 1 View more /hidden_112 Private <100GB ID 16461
Ransomware	bac*******.com.au id16460 View details	2024-12-30	Australia	Communication / Marketing	—	pending
bac***********.com.au Country: Australia Views: 2 View more /hidden_111 Private <100GB ID 16460
Ransomware	Town of Ponoka id16459 View details	2024-12-30	Canada	Public Sector	—	pending
Ponoka.ca Country: Canada Views: 52073 View more /ponoka Public 110GB ID 16459
Ransomware	Kai*********.de id16220 View details	2024-12-20	Germany	Communication / Marketing	—	pending
Kai*************.de Country: germany Views: 0 View more /hidden_109 Private <100GB ID 16220
Ransomware	Ne*******.de id16219 View details	2024-12-20	Germany	Communication / Marketing	—	pending
Country: germany Views: 0 View more /hidden_110 Private 227GB ID 16219
Ransomware	Fmp.gob.pe id16218 View details	2024-12-20	Peru	Communication / Marketing	—	pending
[AI generated] Fmp.gob.pe refers to the Fondo MIVIVIENDA, a Peruvian government initiative aimed at facilitating access to affordable housing. It provides financial products and services to support homeownership, particularly for low- and middle-income families. The organization focuses on promoting sustainable urban development and improving living conditions through accessible mortgage loans and housing programs. ID 16218
Ransomware	Ukh-hof.de id15964 View details	2024-12-10	Germany	Public Sector	—	pending
Ukh-hof.de Country: Germany Views: 56 View more /ukh Public <100GB ID 15964
Ransomware	Orthopaedie-hof.de id15965 View details	2024-12-10	Germany	Public Sector	—	pending
Orthopaedie-hof.de Country: Germany Views: 51 View more /ortho Public <100GB ID 15965
Ransomware	N********.uk id15966 View details	2024-12-10	United Kingdom	Communication / Marketing		pending
N************.uk Country: United Kingdom Views: 0 View more /hidden_108 Private 125GB ID 15966
Ransomware	Donnewalddistributing id15866 View details	2024-12-05	United States	Public Sector		pending
Country: USA Views: 61 View more /donne Public <100GB ID 15866
Ransomware	o**************v id15772 View details	2024-11-30		Other		pending
No additional victim description available. ID 15772
Ransomware	Glo**********.com id15773 View details	2024-11-30		Other		pending
No additional victim description available. ID 15773
Ransomware	SCAFF'HOLDING id15774 View details	2024-11-30	France	Other		pending
No additional victim description available. ID 15774
Ransomware	Globalresultspr.com id15775 View details	2024-11-30	United States	Communication / Marketing		pending
Globalresultspr.com Country: USA Public 123GB ID 15775
Ransomware	don************.com id15776 View details	2024-11-30	United States	Communication / Marketing		pending
don****************.com Country: USA Private <100GB ID 15776
Ransomware	F********.pe id15777 View details	2024-11-30	Peru	Communication / Marketing		pending
F************.pe Country: Peru Private 221GB ID 15777
Ransomware	Uk*******.de id15778 View details	2024-11-30	Germany	Communication / Marketing		pending
Country: Germany Views: 0 Private <100GB ID 15778
Ransomware	Or*********.de id15779 View details	2024-11-30	Germany	Communication / Marketing		pending
Country: Germany Views: 0 Private <100GB ID 15779
Ransomware	Ma********.de id15780 View details	2024-11-30	Germany	Communication / Marketing		pending
Country: Germany Views: 0 Private 134GB ID 15780
Ransomware	Bw******.at id15781 View details	2024-11-30	Austria	Communication / Marketing		pending
Country: Austria Views: 0 Private 122GB ID 15781
Ransomware	mm****.com id14900 View details	2024-10-22	Ireland	Other	—	pending
Country: Ireland ID 14900
Ransomware	Ful********.com id14466 View details	2024-09-26	United States	Other	—	pending
Country: USA ID 14466
Ransomware	Te***********.net id14465 View details	2024-09-26	Italy	Other	—	pending
Country: italy ID 14465
Ransomware	Pennvet.com id14452 View details	2024-09-25	United States	Other	—	pending
Country: USA ID 14452
Ransomware	Wertachkliniken.de id14387 View details	2024-09-19	Germany	Other	—	pending
Country: germany ID 14387
Ransomware	Pen*************.com id14154 View details	2024-09-03	United States	Other	—	pending
Country: USA ID 14154
Ransomware	El******.hu id14153 View details	2024-09-03	United States	Other	—	pending
Country: USA ID 14153
Ransomware	we************.de id14152 View details	2024-09-03	Germany	Other	—	pending
Country: germany ID 14152
Ransomware	Stjamesplace.org id13958 View details	2024-08-23	United States	Other	—	pending
Country: USA ID 13958
Ransomware	Dunlop Aircraft Tyres id13927 View details	2024-08-21	United Kingdom	Other	—	pending
Country: United Kingdom ID 13927
Ransomware	Vibo.dk id13926 View details	2024-08-21	Denmark	Other	—	pending
Country: Denmark ID 13926
Ransomware	Hvb-ingenieure.de id13925 View details	2024-08-21	Germany	Other	—	pending
Country: germany ID 13925
Ransomware	Westermans.com id13924 View details	2024-08-21	United Kingdom	Other	—	pending
Country: United Kingdom ID 13924
Ransomware	Entr**********.fr id13835 View details	2024-08-14	France	Other	—	pending
Country: France ID 13835
Ransomware	Cb******.com id13834 View details	2024-08-14	Cyprus	Communication / Marketing	—	pending
Country: Cyprus ID 13834
Ransomware	St**********.org id13693 View details	2024-08-05	United States	Other	—	pending
Country: USA ID 13693
Ransomware	Dd***uk id13645 View details	2024-08-01	United Kingdom	Other	—	pending
Country: United Kingdom ID 13645
Ransomware	Kalaswire.com id13584 View details	2024-07-27	United States	Other	—	pending
Country: USA ID 13584
Ransomware	Hv*********.de id13468 View details	2024-07-22	Germany	Other	—	pending
Country: germany ID 13468
Ransomware	We***.com id13467 View details	2024-07-22	United Kingdom	Other	—	pending
Country: United Kingdom ID 13467
Ransomware	Ka**.com id13466 View details	2024-07-22	United States	Other	—	pending
Country: USA ID 13466
Ransomware	upcli.com id13349 View details	2024-07-15	United States	Other	—	pending
Country: USA ID 13349
Ransomware	Vi*****.dk id13348 View details	2024-07-15	Denmark	Other	—	pending
Country: Denmark ID 13348
Ransomware	Abileneisd.org id13253 View details	2024-07-04	United States	Other	—	pending
Country: USA ID 13253
Ransomware	Dun*************uk id13252 View details	2024-07-04	United Kingdom	Other	—	pending
Country: United Kingdom ID 13252
Ransomware	P****.pl id13211 View details	2024-06-30	Poland	Other	—	pending
Country: Poland ID 13211
Ransomware	Unit*************.com id13210 View details	2024-06-30	United States	Other	—	pending
Country: USA ID 13210
Ransomware	Longviewbridge.com id13172 View details	2024-06-27	United States	Other	—	pending
Country: USA ID 13172

Cloak

Overview

Leak Status Distribution

Top Countries

Known Leak Locations (1)

Top Activity Sectors (13)

Typical Attacks (10)

Ransom Notes (3)

Victims (166)

Restricted Access

Now you can see the leak, not just the listing