First listed
Victim claimAccuick listed by cipherforce
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor Claimedcipherforce
CipherForce is a newly emerged ransomware group first detected in early 2026, operating a dark web leak site and targeting technology, business services, and logistics companies across the US, China, Vietnam, India, and UAE, with at least 6 claimed victims.
Activity timeline
A dated ledger of actor-claimed victims, campaigns, indicators, identity mappings, relationships, and CVE links. Each date states what it measures. For extensive leak-site histories, victim entries are limited to the 100 most recent distinct listings.
First listed
Victim claimZip24 - ShipOx listed by cipherforce
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor ClaimedFirst listed
Victim claimFindNear listed by cipherforce
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor ClaimedFirst listed
Victim claimtektreeinc.com listed by cipherforce
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor ClaimedFirst listed
Victim claimhiringsteps.com listed by cipherforce
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor ClaimedFirst listed
Victim claimBiaodianyun Group Ltd listed by cipherforce
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor ClaimedLast observed
Indicator1 indicator cataloged
Types: onion.
Identity and attribution
Exact names and tracking identifiers resolve to this canonical profile. Rebrands, affiliations, and overlapping clusters remain separate confidence-rated relationships.
Name map
cipherforceCanonical Name
Loading CVEs, techniques, indicators, malware, victims, and activity...