A single extortion claim tied to Cloak and a bare victim label shows how modern ransomware can signal danger long before defenders can verify what really happened.