cipherforce

CipherForce is a relatively new ransomware group that emerged in February 2026, appearing to be financially motivated based on their targeting patterns and operational characteristics. Given their recent emergence and limited public documentation, details about their specific country of origin and affiliations remain unclear, though their targeting of victims across the United States, United Arab Emirates, India, China, and Vietnam suggests either a geographically distributed operation or deliberate international scope. With only six known victims documented to date, the group appears to focus on technology companies, business services, and transportation/logistics sectors, though their attack methodology and specific tools have not been extensively documented by major threat intelligence firms or law enforcement agencies. No notable high-profile campaigns or significant ransoms have been publicly reported by CISA, FBI, or established security researchers, likely due to the group's recent emergence and relatively small victim count. CipherForce appears to remain active as of current reporting, though their limited operational history makes it difficult to assess their long-term viability or potential for expansion.