Loading malware…
CipherForce is a ransomware operation associated with the financially motivated threat group TeamPCP. It is assessed to be TeamPCP’s in-house ransomware brand, distinct from the group’s separate partnership with the Vect ransomware ecosystem, and was used as one of multiple monetization channels following TeamPCP’s large-scale credential theft and software supply-chain compromises in 2026. Reporting indicates TeamPCP operated CipherForce in parallel with affiliate-oriented ransomware activity, using stolen enterprise access and harvested secrets to support direct extortion operations.
CipherForce has been described as proprietary TeamPCP tooling and branding rather than merely a leak persona. TeamPCP promoted CipherForce-branded capabilities designed to encrypt major enterprise database and cloud storage solutions, indicating an enterprise-focused ransomware model aimed at high-value environments. Publicly observed leak-site activity tied to CipherForce showed a limited number of named victims in early 2026 before the infrastructure later went offline and was subsequently rebranded toward TeamPCP branding.
The broader TeamPCP ecosystem that supported CipherForce was heavily tied to post-compromise credential theft, cloud and SaaS access abuse, data exfiltration, and downstream extortion. TeamPCP’s supply-chain intrusions against developer and security tooling were used to harvest credentials at scale, after which the group and aligned actors exploited stolen access for cloud discovery, lateral movement, data theft, and ransomware deployment. CipherForce therefore appears to fit into a broader intrusion-to-extortion pipeline in which compromised credentials and enterprise access were converted into ransomware operations against downstream victims.
CipherForce is linked to Windows and enterprise cloud or storage environments through TeamPCP’s advertised encryption focus, but detailed technical analysis of the locker itself remains limited in the available information. High-confidence reporting supports classification of CipherForce as ransomware associated with TeamPCP and used for direct operations separate from Vect.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
19 mars 2026 : Compromission de Trivy (scanner de vulnérabilités Aqua Security) via un tag malveillant v0.69.4 ( CVE-2026-33634 , CVSS v4 : 9.4). Propagation via GitHub Releases, Docker Hub, AWS ECR et GitHub Container Registry en ~4 heures.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
12 distinct techniques documented for this family, organized by ATT&CK tactic.
TeamPCP's own Telegram channel states: "you may already know us as TeamPCP or Shellforce... CipherForce is a newer project we are starting to find affiliates."
CipherForce is a newer project we are starting to find affiliates... This means TeamPCP is running two parallel ransomware tracks simultaneously: their proprietary CipherForce program for direct operations, and the mass Vect affiliate program via BreachForums for distributed operations.
The strongest attribution link across all TeamPCP operations is a shared RSA-4096 public key embedded in payloads -- search for this key in forensic artifacts from any suspected TeamPCP exposure.
the Sportradar AG breach ... has been confirmed as a "systemic compromise" jointly operated by TeamPCP and Vect ransomware.
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An in-house ransomware brand operated by TeamPCP.
Ransomware/locker brand previously operated by TeamPCP before its formal partnership with Vect. TeamPCP stated it used its own CipherForce locker rather than Vect encryption tools.
A ransomware or extortion channel mentioned only as an inactive affiliated monetization path during the reporting period.
Ransomware-branded tooling associated with TeamPCP, designed to encrypt major enterprise database and cloud storage solutions; described as part of TeamPCP's proprietary ransomware program.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.