Cloak Ransomware Claims Attack on Virginia Attorney General’s Office

Cloak ransomware claimed responsibility for an attack on the Virginia Attorney General’s Office that rendered nearly all computer systems and services offline and later resulted in allegedly stolen data being published on the group's leak site; the report profiles Cloak as a RaaS actor using an ARCrypter variant derived from Babuk code, detailing its access methods (IABs, phishing), payload deployment, encryption (HC-128), evasion and persistence techniques, and extortion/double-extortion business model.