Rook
Rook is a ransomware group with a financial motive, tracked by Brandefense. It targets the Diplomacy sector.
- Techniques
- 0
- Exploited CVEs
- No CVE data
- Last seen
- Dec 31, 2021
- Record updated
Who They Target.
Sectors · 1
Labelsransomware
About Rook.
According to PCrisk, Rook is ransomware (an updated variant of Babuk) that prevents victims from accessing/opening files by encrypting them. It also modifies filenames and creates a text file/ransom note (HowToRestoreYourFiles.txt). Rook renames files by appending the.Rook extension. For example, it renames 1.jpg to 1.jpg.Rook, 2.jpg to 2.jpg.Rook.
Last updated Oct 1, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.