Loading story…
The CipherForce ransomware operation has listed Biaodianyun Group Ltd and hiringsteps[.]com as victims, indicating two additional organizations have been added to the group’s public leak infrastructure. The postings were surfaced by RedPacket Security, which tracked separate victim entries naming both entities.
The disclosures suggest CipherForce is continuing to publicize alleged compromises across different sectors, using victim-name announcements as part of its extortion strategy. While the available references do not provide technical details on intrusion methods, encryption activity, or data volume, the victim listings indicate claimed ransomware-related breaches affecting both Biaodianyun Group Ltd and HiringSteps.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
A RedPacket Security reference indicates that the CipherForce ransomware operation claimed Zip24 / ShipOx as a victim. No additional incident details or timing beyond the publication context were provided.
A RedPacket Security reference indicates that the CipherForce ransomware operation claimed tektreeinc.com as a victim. No additional incident details or timing beyond the publication context were provided.
A RedPacket Security reference indicates that the CipherForce ransomware operation claimed Biaodianyun Group Ltd as a victim. No additional incident details or timing beyond the publication context were provided.
A RedPacket Security reference indicates that the CipherForce ransomware operation claimed hiringsteps.com as a victim. No additional incident details or timing beyond the publication context were provided.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
redpacketsecurity.com
Open sourceredpacketsecurity.com
Open sourceredpacketsecurity.com
Open sourceredpacketsecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
GuidePoint Security's GRIT reported that an entity calling itself **"Ransom Busters"** contacted ransomware victims with unsolicited offers to recover encrypted files and delete stolen data, claiming it had access to ransomware groups' infrastructure and encryption keys. Investigators assessed with moderate confidence that the operation was not a legitimate incident-recovery service but a ransomware affiliate conducting secondary extortion across multiple ransomware-as-a-service ecosystems, including intrusions linked to **DragonForce**, **Settra**, and **Anubis**. In several cases, the outreach arrived before the incidents were publicly disclosed, raising concerns that the sender had direct knowledge of the attacks. GRIT tied the activity together through overlapping tooling and infrastructure, including **SoftPerfect Network Scanner**, **s5cmd**, **Remotely**, a reused local backdoor password, and a shared attacker-controlled hostname. The actor reportedly demanded **$20,000 to $60,000** and pushed for **Bitcoin** payment while using a privacy-focused email service and early pricing demands as part of the scheme. Researchers said the campaign appears designed to divert ransom negotiations and let an affiliate monetize victims outside the normal revenue-sharing model, and they urged organizations to preserve the messages as evidence and work with incident responders and law enforcement rather than pay the actor.
Aug 20, 2026
Palo Alto Networks Unit 42 published a threat assessment of **BianLian**, describing a financially motivated cybercrime group that has shifted from traditional ransomware deployment toward **data theft and extortion**. The group has targeted organizations across multiple sectors and is known for gaining initial access through valid remote access credentials and exposed services, then moving laterally, escalating privileges, and exfiltrating sensitive data before pressuring victims to pay. The assessment says BianLian has used a flexible intrusion playbook that includes remote desktop and VPN access, hands-on-keyboard activity, and the use of legitimate administrative tools to blend into victim environments. The report highlights the group’s evolution from encrypting systems to emphasizing **double extortion** and notes that defenders should focus on hardening remote access, monitoring for credential abuse, and detecting suspicious lateral movement and data exfiltration tied to the actor’s operations.
Jul 12, 2026
Ransomware monitoring sources recorded a surge of victim claims led by **Qilin**, which posted attacks against organizations in the United States, Argentina, France, Italy, Peru, Brazil, Turkey, and the United Kingdom. Named victims included **Cafar**, **Droguería Martorani**, **AK Preparedness**, **Armara**, **Sicc**, **KLD Labs**, **St Martha Catholic Church**, **Salina Supply**, **The Nueva School**, **City Ambulance Service**, **Famesa**, **Associated Theatrical Contractors**, **Don Tortaco Mexican Grill**, **Eana**, **PP+K**, **Synergy Products**, and **Bolt & Nut Manufacturing**. The affected sectors spanned healthcare, education, manufacturing, agriculture and food production, hospitality, technology, business services, and religious organizations, underscoring broad opportunistic targeting rather than a single-industry campaign. Other groups also continued to post new victims. **Incransom** claimed attacks on **v-silicon.com** in Taiwan, **Reatile Group** in South Africa, **Vedan Corp** in Vietnam, and **V&P Nurseries** in the United States; **DragonForce** claimed **NewNet S.A.** in Colombia and separately threatened Switzerland's **Ifage** with publication of **850 GB** of allegedly stolen data after an earlier intrusion; **Krybit** listed **Euroins Insurance Company AD** in Bulgaria; and **Akira** claimed **McKeever, Varga & Senko** in the United States, alleging theft of **12 GB** of corporate and personal data. A weekly ransomware trend report based on **eCrime.ch** data counted **187** claims for the period, down from **233** the prior week, but still identified **Qilin** as the most active group with **33** claims, ahead of **DragonForce** with **27**.
Sep 1, 2026