CipherForce

CipherForce is a ransomware operation associated with the financially motivated threat group TeamPCP. It emerged as TeamPCP’s proprietary ransomware track, distinct from the group’s separate cooperation with the Vect ransomware ecosystem, and has been used as a direct monetization channel for access and credentials harvested during TeamPCP’s broader cloud and software supply-chain intrusions. Reporting links CipherForce to TeamPCP’s wider criminal infrastructure and aliases, and indicates the operation maintained its own leak site and victim publication workflow.

CipherForce has been described as TeamPCP’s in-house ransomware brand, including tooling advertised as capable of encrypting major enterprise database and cloud storage solutions. The operation appears to have run in parallel with TeamPCP’s credential-theft and initial-access activity, allowing the group to convert stolen secrets and downstream enterprise access into extortion and ransomware deployments. Intelligence also indicates TeamPCP sought affiliates for CipherForce while simultaneously supporting a separate affiliate-oriented ransomware channel through Vect.

Victimology associated with TeamPCP-linked operations indicates interest in enterprise and cloud-centric environments across multiple sectors and geographies, including technology, financial services, retail, legal, insurance, education, government, and other large organizations. CipherForce has been publicly tied to named victims on its leak infrastructure, and has been discussed in connection with ransomware activity following TeamPCP’s compromises of trusted developer and security tooling. High-confidence reporting supports classifying CipherForce as a ransomware brand operated by TeamPCP for extortion and encryption-based attacks, but detailed technical specifics of the locker itself remain limited in the available information.