rook
Activity analysis
HackerFeeds has tracked 9 victims claimed by rook since December 2021, most recently in January 2022 — ranking #225 of 332 groups (0% of all tracked ransomware victims). No new victims have been posted in the last 180 days; the most recent claim was in January 2022. Its most-targeted sector is Technology (2 victims), followed by Manufacturing (2). Japan accounts for 1 victims (100% of those with a known location); 8 victims did not disclose a location.
Victims per year
- 20218
- 20221
Top sectors
- Technology2
- Manufacturing2
- Healthcare1
- Energy1
- Consumer Services1
- Business Services1
Top countries
Computed from victims claimed on the group's leak site as collected by HackerFeeds; claims are not independently verified. Monthly reports · Methodology
Group profile
According to PCrisk, Rook is ransomware (an updated variant of Babuk) that prevents victims from accessing/opening files by encrypting them. It also modifies filenames and creates a text file/ransom note (HowToRestoreYourFiles.txt). Rook renames files by appending the .Rook extension. For example, it renames 1.jpg to 1.jpg.Rook, 2.jpg to 2.jpg.Rook.
Recent victims
No victims tracked yet.