cipherforce
Intelligence Profile
CipherForce is a newly emerged ransomware group first detected in early 2026, operating a dark web leak site and targeting technology, business services, and logistics companies across the US, China, Vietnam, India, and UAE, with at least 6 claimed victims.
Threat Analysis
cipherforce is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of financial.
Financially motivated threat actors like cipherforce prioritize monetary gain through methods such as ransomware deployment, banking trojans, cryptocurrency theft, BEC scams, or credential harvesting for resale on underground markets.
Known Campaigns
Cipherforce is conducting an active ransomware campaign targeting organizations across 0 countries. 6 confirmed victims recorded in the last 45 days. Campaign status: ACTIVE (last activity 26 Mar 2026).