// THREAT ACTOR
CIPHERFORCE_
DormantCIPHERFORCE is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem — file encryption combined with the threat of stolen-data publication on a public leak site — and continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of CIPHERFORCE — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.
Victims by year
- 2026 12
Leak site mirrors
2 mirrors tracked, 0 currently reachable. These are criminal-infrastructure URLs — links are deliberately not provided.
-
o3ydbkayttkyg4iw2nc732jxmmex25bjeyqyvuuyngnxmpehdefjr3qd.onionCipherForce Leak Site - Home snapshot · 2026-02-23 23:15 -
22evxpggnkyrxpluewqsrv5j4jtde6hut2peq3w44d6ase676qlkoead.onionTEAM PCP snapshot · 2026-08-02 14:22
Recent victims
The 50 most recent victims claimed by CIPHERFORCE. Total in the index: 12.
| Date listed | Victim | Description |
|---|---|---|
| 2026-03-26 | BMW Group Internal Documents/Recon | |
| 2026-03-26 | Sportradar.io | |
| 2026-03-23 | Tuna.uy | |
| 2026-03-14 | Liberty Tax | |
| 2026-03-11 | TCT Broadband Solutions | |
| 2026-03-11 | Telcom Live Content Inc | |
| 2026-02-23 | Accuick | |
| 2026-02-23 | Zip24 - ShipOx | Over 27 million rows of PII from ShipOx by Zip24 have been exfiltrated… |
| 2026-02-23 | FindNear | FindNear (findnear.vn) is a Vietnamese multi-utility app and platform,… |
| 2026-02-23 | tektreeinc.com | Previously this was for sale, no one bought it, so we are asking for a… |
| 2026-02-23 | hiringsteps.com | This breach includes: Full Name Location Company Job Title Emai… |
| 2026-02-23 | Biaodianyun Group Ltd | Biaodianyun Group Ltd is a Chinese technology company that specializes… |