Cloak Ransomware Recovery: ARCrypter Encryption and Bought Network Access

Cloak emerged in late 2022 or early 2023 and has mostly listed small and medium-sized businesses in Europe, Germany above all, and Asia. ransomware.live counts about 170 victim claims on its leak site, and it was still posting victims in October 2026. In February 2025 Cloak claimed an attack on the Virginia Attorney General's Office and later published data it said came from it; the office did not confirm the group's claims.

Researchers at Cyberint and others describe Cloak buying footholds from initial access brokers, using employee logins offered for sale on underground markets, alongside phishing, malvertising and fake Windows installers. For encryption it uses a variant of ARCrypter, which Halcyon traces to the leaked Babuk source code. A related operation, Good Day, uses the same encryptor family, and SentinelOne has reported ties between the two.

There is no public Cloak decryptor. We work on the encrypted files themselves: databases, virtual disks, backup files and file-server data. Where the encryptor left parts of large files untouched, we recover the tables, virtual machines and folders from those parts.

Keep the encrypted files and a copy of them, and change every password that may have been sold: access brokers often sell the same access more than once. Contact us for a free assessment. No data, no charge.