Cloak
A ransomware operation that buys access from initial access brokers and has mainly targeted smaller European organisations. Halcyon traces its code to leaked Babuk source through the ARCrypter family.
Threat actor profile. Last reviewed 3 November 2026.
Why It Matters
Halcyon says Cloak buys pre-compromised RDP, VPN and domain credentials, often from info-stealer campaigns, and that it does not exploit specific CVEs. ISH reports the same broker pattern.2,4
SentinelOne found that Good Day ransomware victims, from the ARCrypter family, were listed on Cloak's extortion site, based on a limited set of samples.1 Halcyon says the Cloak payload appears to derive from leaked Babuk source code.5
Halcyon says about three-quarters of documented incidents are in Europe, with Germany the most concentrated, expanding to North America and Asia in 2024 and 2025.2 The sources we opened do not establish a UK link.
If access is bought, the attack may begin long before anyone notices. We would treat stolen credential monitoring and MFA on RDP and VPN as the priorities.
How It Attacks
Based on Halcyon's threat profile and technical analysis.2,5
- 1
Buy the Way In
Purchases credentials from brokers. Phishing and exploitation are secondary routes.
- 2
Run From a Virtual Disk
Creates and mounts a virtual disk to run the payload, which helps it avoid antivirus.
- 3
Hold On
Sets a Run key disguised as Windows Update.
- 4
Disable and Disrupt
Stops security, backup, database and mail services and blocks Task Manager and logoff.
- 5
Encrypt
Deletes shadow copies and encrypts files, in part for larger files.
Key Techniques
Our mapping of the behaviour Halcyon describes.5 Cloak has no ATT&CK v20 entry.
| ID | Technique | Tactic | What It Looks Like |
|---|---|---|---|
| T1078 | Valid Accounts | Initial Access | Uses purchased credentials. |
| T1547.001 | Registry Run Keys / Startup Folder | Persistence | Sets a Run key for startup. |
| T1036 | Masquerading | Stealth | Names its Run key after Windows Update. |
| T1489 | Service Stop | Impact | Stops antivirus, backup and database services. |
| T1490 | Inhibit System Recovery | Impact | Deletes shadow copies. |
| T1486 | Data Encrypted for Impact | Impact | Encrypts files, partly for larger ones. |
Key Events
Forms, according to Halcyon.2
Leak site appears, and SentinelOne connects Good Day victims to it.1
Affiliate programme launches, according to Halcyon.2
Halcyon publishes technical analysis of a variant.5
Claims an attack on a US state attorney general's office, not verified at the time.6
Claims an attack on a US city, which later notifies people of a breach but has not acknowledged Cloak's claim.3,7
Warning Signs
Drawn from Halcyon's analysis.5 None of these proves an attack alone.
- Unexpected use of diskpart to create or attach virtual disks
- A new Run key named Windows Update
- Explorer policies blocking Task Manager or logoff
- Sudden stopping of backup and security services
Defences That Matter
Protect Remote Access
- Require phishing-resistant MFA on VPN, RDP and administrator accounts.
- Remove internet-facing RDP where possible and review dormant accounts.
Watch for Hands-On Activity
- Monitor for unapproved remote access tools, renamed file transfer utilities and large outbound transfers.
- Alert on attempts to stop security tools or delete shadow copies.
Prepare for Encryption
- Keep offline, immutable backups and test that they restore.
- Include virtualisation hosts and backup servers in recovery tests.
Are Your Credentials Already for Sale?
We can help you find exposed credentials and strengthen the accounts that matter most.
Sources
- SentinelOne: Threat actor interplay: Good Day's victim portals and their ties to Cloak, 30 August 2023
- Halcyon: Cloak threat group profile, updated 13 November 2025
- Comparitech: report on a US city's data breach notice, 4 May 2026
- ISH: CloAk ransomware encrypts data and operates with other groups, undated
- Halcyon: Cloak ransomware variant exhibits advanced persistence, evasion and VHD extraction capabilities, 12 December 2024
- Comparitech: report on a Cloak claim against a US state attorney general's office, 20 March 2025
- Comparitech: Government ransomware roundup, H1 2026, 14 July 2026
MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK terms of use.