CipherForce
CipherForce is a ransomware operation associated with the financially motivated cybercriminal group TeamPCP. The content describes it as TeamPCP’s proprietary ransomware brand, distinct from the group’s separate partnership with the Vect ransomware ecosystem. TeamPCP publicly indicated via Telegram that CipherForce was a newer project and was seeking affiliates, and reporting assessed that the group was operating two parallel ransomware tracks: direct operations via CipherForce and distributed affiliate activity via Vect. TeamPCP is also tracked under the aliases PCPcat, ShellForce, DeadCatx3, and Persy_PCP, with CipherForce listed as one of its confirmed aliases/operational personas. The broader TeamPCP campaign involved large-scale software supply chain compromises across GitHub Actions, PyPI, npm, Docker Hub/GHCR, and OpenVSX; theft of roughly 300 GB of credentials and data; and subsequent monetization through credential exploitation and ransomware. A shared RSA-4096 public key embedded in payloads is cited as the strongest attribution artifact linking TeamPCP operations, including CipherForce. The available content does not provide high-confidence technical details on CipherForce’s encryption routine, ransom note contents, specific infection vector, or confirmed deployment victims, and one report explicitly states that no confirmed CipherForce deployments had yet been observed during the referenced campaign window.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
CERT-EU disclosed on April 2-3, 2026 that the European Commission's Europa web hosting platform on AWS was breached through the Trivy supply chain compromise (CVE-2026-33634).
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Techniques & procedures
9 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
2 techniquesTeamPCP's own Telegram channel states: "you may already know us as TeamPCP or Shellforce... CipherForce is a newer project we are starting to find affiliates."
CipherForce is a newer project we are starting to find affiliates... This means TeamPCP is running two parallel ransomware tracks simultaneously: their proprietary CipherForce program for direct operations, and the mass Vect affiliate program via BreachForums for distributed operations.
Initial Access
1 techniquePersistence
1 techniqueStealth
1 techniqueThe strongest attribution link across all TeamPCP operations is a shared RSA-4096 public key embedded in payloads -- search for this key in forensic artifacts from any suspected TeamPCP exposure.
Credential Access
1 techniqueThe strongest attribution link across all TeamPCP operations is a shared RSA-4096 public key embedded in payloads -- search for this key in forensic artifacts from any suspected TeamPCP exposure.
Exfiltration
1 techniqueShinyHunters published the stolen data on their dark web leak site on March 28
Impact
3 techniquesNew intelligence reveals that Vect is not TeamPCP's only ransomware channel... CipherForce is TeamPCP's own ransomware operation, separate from the Vect partnership. This means TeamPCP is running two parallel ransomware tracks simultaneously.
The strongest attribution link across all TeamPCP operations is a shared RSA-4096 public key embedded in payloads -- search for this key in forensic artifacts from any suspected TeamPCP exposure.
ShinyHunters published the stolen data on their dark web leak site on March 28.
IOCs tracked for this family
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Recent activity
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a named ransomware family via its leak/blog site in the context of tracking the VECT-TeamPCP alliance.
A proprietary ransomware operation launched by TeamPCP as part of its monetization efforts following the supply chain compromises.
A proprietary ransomware operation run by TeamPCP as part of a dual-track extortion model alongside its supply chain and access-generation activity.
Keywords: ownCloud ... ransomware ... Vect ... CipherForce ... CanisterWorm ...
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.