Ransomware group profile · #230 by claimed victims

Rook ransomware

According to PCrisk, Rook is ransomware (an updated variant of Babuk) that prevents victims from accessing/opening files by encrypting them. It also modifies filenames and creates a text file/ransom note (HowToRestoreYourFiles.txt). Rook renames files by appending the .Rook extension. For example, it renames 1.jpg to 1.jpg.Rook, 2.jpg to 2.jpg.Rook.

Active First seen Dec 2021

9Victims claimed on leak sites

0Victims in the last 30 days

0Victims in the last 90 days

1Countries hit

1Leak-site URLs tracked, 0 online

8 Jan 2022Latest claim recorded

Victimology

Who Rook claims to have breached, from 9 leak-site posts recorded by VULONE.

Claims per month last 12 months

Top sectors

Manufacturing2

Technology2

Healthcare1

Professional Services1

Energy & Utilities1

Retail & E-Commerce1

Top countries

Japan1

Latest claimed victims 9 most recent

Victim	Sector	Country	Claimed
Abdi ibrahim	Healthcare	-	8 Jan 2022
Evalueserve	Professional Services	-	28 Dec 2021
DENSO denso.com	Manufacturing	JP	28 Dec 2021
Data breach summary	Not Found	-	26 Dec 2021
Rossell Techsys(Data will be given tomorrow)	Technology	-	18 Dec 2021
KMG Prestige, Inc. (Data will be given tomorrow) kmg prestige, inc. (data will be given tomorrow)	Energy & Utilities	-	18 Dec 2021
Rosendahl Design Group	Retail & E-Commerce	-	14 Dec 2021
Rossell Techsys	Technology	-	14 Dec 2021
KMG Prestige, Inc. kmg prestige, inc.	Manufacturing	-	7 Dec 2021

All 9 Rook victims, searchable

Full victim list with claim posts, domains, timing and exports, plus the negotiation chats and leak-site screenshots VULONE archives for this crew.

Start free Sign in

Tactics, techniques and procedures

ATT&CK technique mapping for Rook is in progress. Victimology, infrastructure status and leak-site tracking are live above.

Indicators, detections and the full playbook

Hashes, C2 addresses, onion services, Sigma and YARA detections per technique, and the negotiation transcripts are available to signed-in analysts.

See full IOCs

Frequently asked

Is Rook ransomware still active?

Rook is tracked as active. The most recent leak-site claim VULONE recorded is dated 8 January 2022.

How many victims has Rook claimed?

VULONE has recorded 9 leak-site victim claims attributed to Rook since December 2021, across 1 countries and 7 sectors.

Which industries does Rook target?

The sectors most often named on the Rook leak site are Manufacturing, Technology, Healthcare.

Which countries are most affected by Rook?

Most Rook victims recorded by VULONE are located in Japan.

Where does VULONE get Rook victim data?

Claims are collected continuously from the group's own leak sites and cross-checked with ransomware.live and RansomLook. A claim is the group's assertion, not a confirmed breach.

VULONE research mentioning Rook

Inside China’s Exposed “Key Figures” Database for Ethnic External PropagandaOn October 24, 2026, the VULONE Team discovered an operational Chinese database titled 民族外宣重点人物信息库 (Key Figures Information Database for Eth

Other ransomware groups

Victim claims are collected from leak sites and enrichment partners (ransomware.live, RansomLook) and represent the group's own assertions, not confirmed breaches. Profile last updated 31 October 2026. Questions or corrections: research@vulone.com.