Cloak Ransomware

Description Summary

Renewed surge through Q4 2025; distinctive VHD-based evasion.

Threat Actor

RaaS (85/15 split, no upfront fee); 'Good Day'/ARCrypter lineage; runs payload from virtual hard disks (VHD) + Neshta file infector for self-propagation.

Technical Indicators

Encryption Extension
Not publicly reported
Encryption Algorithm
HC-128 with keys via Curve25519 + SHA-512
Ransom Note Name
Not publicly reported
Targeted Industries
Cross-sector (per leak-site victim telemetry)
First Seen
RaaS since February 2024
Last Seen
Active (Q4 2025 surge)
Geographical Location
Global / not publicly profiled

MITRE ATT&CK Matrix

Tactic TTP Technique Name
Impact x 2 T1486 Data Encrypted for Impact
T1490 Inhibit System Recovery
Exfiltration x 1 T1567 Exfiltration Over Web Service (leak site)
Initial Access x 2 T1190 Exploit Public-Facing Application
T1078 Valid Accounts