Threat Intelligence Report August 20 - August 26 2024

Cloak Ransomware

Cloak ransomware, first detected in late 2022, quickly established itself as a formidable threat in the cybercrime landscape. This stealthy malware employs a double extortion tactic, encrypting victims' data and threatening to leak it on the dark web if ransom demands aren't met. While the exact origins of Cloak remain shrouded in some mystery, security researchers believe it may be linked to a cybercriminal group operating out of Eastern Europe. This group's previous activities suggest a level of sophistication in malware development and deployment, making Cloak a particularly dangerous adversary.

As previously mentioned, Cloak Ransomware began compromising victims in late 2022. Throughout 2023, it claimed to have successfully attacked 32 organisations worldwide. Germany and the United States were among the countries most heavily affected by Cloak Ransomware during this period.

Figure 2: Countries hit by Cloak Ransomware in 2023

However, as of the date, we are writing this report, Cloak Ransomware has already claimed to have attacked 32 countries in 2024. Following the trend from the previous year, the United States and Germany remain the primary targets.

Figure 3: Countries hit by Cloak Ransomware in 2024

TTPs:

Cloak ransomware doesn't rely solely on brute force. It possesses a diverse arsenal of tactics, techniques, and procedures (TTPs) to infiltrate and compromise systems stealthily. Here's a glimpse into its malicious toolkit:

• Phishing Attacks: Deceptive emails designed to trick users into clicking malicious links or downloading infected attachments are a common entry point. These emails often mimic legitimate business communications, making them more likely to be clicked.
  
  
• Exploiting Unpatched Vulnerabilities: Cloak actively seeks out unpatched vulnerabilities in software and operating systems to gain unauthorised access to networks. This underscores the importance of keeping all software and systems updated with the latest security patches.
  
  
• Remote Desktop Protocol (RDP) Exploitation: Like other ransomware strains, Cloak can exploit weaknesses in RDP configurations to gain access to a system. RDP allows remote access to a computer, and misconfigured settings can create a vulnerability for attackers.
  
  
• Supply Chain Attacks: Cloak has shown a preference for targeting supply chains, compromising vendors and suppliers to gain access to a wider network of victims. This tactic allows attackers to reach a larger number of victims with a single intrusion.
  
  
• Lateral Movement: Once a foothold is established on a single system, Cloak can utilise various tools to move laterally across a network. This allows it to infect additional devices, escalate privileges, and potentially compromise critical systems.
  
  
• Data Exfiltration: Before encryption, Cloak often exfiltrates sensitive data like financial records, personal information, and intellectual property. This stolen data serves as additional leverage in extortion attempts, putting pressure on victims to pay the ransom.
  
  
• Strong Encryption: The malware utilises robust encryption algorithms to render files inaccessible. Decrypting them without the attacker's key is extremely difficult, if not impossible. This effectively cripples a victim's operations until a decision is made.
  
  

Data Leak Site: Cloak ransomware maintains a data leak site on the dark web where they list victims who haven't paid the ransom. This serves as a public shaming tactic and adds pressure on compromised organisations.

Figure 4: Screenshot of Leak Site used by Cloak Ransomware

Ransom Note

Cloak ransomware, a notorious cyber threat, employs a deceptive tactic in its ransom notes. Rather than demanding a ransom outright, it presents itself as a "data recovery service." This facade aims to manipulate victims into believing they have a chance to recover their encrypted data for a fee.

However, this is a deceptive ploy. Once a victim pays the ransom, there's no guarantee that their data will be decrypted. In many cases, victims are left with no option but to rebuild their systems and data from backups.

Figure 5: Screenshot of Ransom Note used by Cloak Ransomware

A Global Reach with Focused Targets

Cloak ransomware has demonstrated a global reach, targeting victims across various industries and geographies. Here are some examples of its operations and the impact it has caused:

• Healthcare Organisations: Hospitals and other healthcare providers have been frequent targets due to the sensitive nature of patient data and the potential disruption to critical services.
  
  
• Manufacturing Disruptions: Manufacturing companies across the globe have fallen victim to Cloak, experiencing data breaches, operational disruptions, and potential production delays.
  
  
• Financial Institutions: The financial sector has also been targeted, with banks and credit unions facing potential data breaches and economic losses.
  
  

The emergence of Cloak ransomware underscores the ever-evolving threat landscape of cybercrime. Its focus on supply chain attacks and the potential for significant disruptions highlights the need for organisations to prioritise robust cybersecurity measures.