Cloak

Cloak is a ransomware group/malware family active since at least late 2022 and described as part of the ransomware-as-a-service ecosystem. Reporting in the provided content states that Cloak ransomware has expanded its presence since emerging in late 2022 and had targeted more than 130 victims by early 2025. It has been observed in ransomware tracking focused on industrial entities, including Dragos reporting incidents attributed to Cloak in late 2023. The malware is described as sharing infrastructure with Good Day (ARCrypter) and using Babuk source code. The content states that Cloak targets global industries. A specifically reported victim was Baltimore City Public Schools, where reporting linked a February 2025 breach affecting about 31,000 individuals to the Cloak ransomware group. High-confidence indicators in the content are limited to the malware/group names and aliases: Cloak, Good Day, ARCrypter, and Babuk source-code lineage.