Loading malware…
CipherForce is a ransomware operation associated with the financially motivated threat group TeamPCP. It is assessed to be TeamPCP’s in-house ransomware brand, distinct from the group’s separate partnership with the Vect ransomware ecosystem, and was used as one of multiple monetization channels following TeamPCP’s large-scale credential theft and software supply-chain compromises in 2026. Reporting indicates TeamPCP operated CipherForce in parallel with affiliate-oriented ransomware activity, using stolen enterprise access and harvested secrets to support direct extortion operations.
CipherForce has been described as proprietary TeamPCP tooling and branding rather than merely a leak persona. TeamPCP promoted CipherForce-branded capabilities designed to encrypt major enterprise database and cloud storage solutions, indicating an enterprise-focused ransomware model aimed at high-value environments. Publicly observed leak-site activity tied to CipherForce showed a limited number of named victims in early 2026 before the infrastructure later went offline and was subsequently rebranded toward TeamPCP branding.
The broader TeamPCP ecosystem that supported CipherForce was heavily tied to post-compromise credential theft, cloud and SaaS access abuse, data exfiltration, and downstream extortion. TeamPCP’s supply-chain intrusions against developer and security tooling were used to harvest credentials at scale, after which the group and aligned actors exploited stolen access for cloud discovery, lateral movement, data theft, and ransomware deployment. CipherForce therefore appears to fit into a broader intrusion-to-extortion pipeline in which compromised credentials and enterprise access were converted into ransomware operations against downstream victims.
CipherForce is linked to Windows and enterprise cloud or storage environments through TeamPCP’s advertised encryption focus, but detailed technical analysis of the locker itself remains limited in the available information. High-confidence reporting supports classification of CipherForce as ransomware associated with TeamPCP and used for direct operations separate from Vect.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
12 distinct techniques documented for this family, organized by ATT&CK tactic.
TeamPCP's own Telegram channel states: "you may already know us as TeamPCP or Shellforce... CipherForce is a newer project we are starting to find affiliates."
CipherForce is a newer project we are starting to find affiliates... This means TeamPCP is running two parallel ransomware tracks simultaneously: their proprietary CipherForce program for direct operations, and the mass Vect affiliate program via BreachForums for distributed operations.
The strongest attribution link across all TeamPCP operations is a shared RSA-4096 public key embedded in payloads -- search for this key in forensic artifacts from any suspected TeamPCP exposure.
TeamPCP escalated dramatically in March 2026 with a cascading supply chain campaign that compromised Aqua Security’s Trivy, Checkmarx KICS, LiteLLM, Telnyx, Palo Alto Networks, and 66+ npm packages.
T1195.002 — Compromise Software Supply Chain (Initial Access)
The strongest attribution link across all TeamPCP operations is a shared RSA-4096 public key embedded in payloads -- search for this key in forensic artifacts from any suspected TeamPCP exposure.
The strongest attribution link across all TeamPCP operations is a shared RSA-4096 public key embedded in payloads -- search for this key in forensic artifacts from any suspected TeamPCP exposure.
The strongest attribution link across all TeamPCP operations is a shared RSA-4096 public key embedded in payloads -- search for this key in forensic artifacts from any suspected TeamPCP exposure.
ShinyHunters published the stolen data on their dark web leak site on March 28
T1485 — Data Destruction (Impact)
the Sportradar AG breach ... has been confirmed as a "systemic compromise" jointly operated by TeamPCP and Vect ransomware.
The strongest attribution link across all TeamPCP operations is a shared RSA-4096 public key embedded in payloads -- search for this key in forensic artifacts from any suspected TeamPCP exposure.
T1657 — Financial Theft (Impact)
6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.