Disclosure context

About cyclops

Cyclops is a relatively minor ransomware group that emerged in July 2023, operating with apparent financial motivations and maintaining a low profile compared to established ransomware families. The group's origin and affiliations remain largely undocumented in public threat intelligence reporting, with limited information available regarding their operational structure or potential ties to other cybercriminal organizations. Based on available data, Cyclops has demonstrated geographically diverse targeting patterns, with documented victims spanning Australia, China, and Guatemala, though their specific attack methodologies, initial access vectors, and encryption techniques have not been extensively analyzed or reported by major security firms or law enforcement agencies. With only seven known victims documented since their emergence, the group represents a relatively small-scale operation that has not conducted any widely publicized high-profile attacks or drawn significant attention from cybersecurity researchers or law enforcement disruption efforts. Current intelligence suggests the group remains active but operates at a scale significantly below major ransomware families that typically dominate threat landscape reporting. The group has been linked to 7 public disclosures across our corpus. First observed on a leak site on July 1, 2023; most recent post July 26, 2023. The operation is currently inactive.

Timeline of this disclosure

July 23, 2023Pechexport listed by cyclopson the group's public leak site

Sector and geography

This disclosure adds to ransomware activity in the Transportation & Logistics sector. Geographically, Pechexport is reported in China, a country with 29 ransomware disclosures in our corpus.

How we know this. Darkfield monitors public ransomware leak sites continuously, archiving every new disclosure and the data later released against the victim. Each entry on this page is sourced from the operator's own publication and cross-checked against complementary OSINT feeds (RansomLook, ransomware.live, RansomWatch). We do not collect or host stolen data — only the metadata, timestamps and screenshots needed to make the public disclosure searchable and accountable. Records here are corrected when the original post is edited, retracted, or merged with another disclosure.

Ransomware victim disclosure

← All victims

Pêchexport

listed as Pechexport · Claimed by cyclops · listed 3 years ago

34m

Age

since listed · data leaked

Status timeline

Listed
Jul 23, 2023
Data leaked

At a glance

Group: cyclops
Status: Data leaked
Country: China
Sector: Transportation & Logistics
Listed on leak site: Jul 23, 2023

About the victim

AI dossier — public-source company profile

Pêchexport is a seafood processing and export company based in Majunga (Mahajanga), Madagascar, operating across an 8,400 m² facility that includes offices, a factory, a laboratory, cold storage, and technical workshops. The company operates a fleet of eight EU- and CIQ-certified freezer trawlers, a CE-approved fish processing plant with a capacity of 5 tonnes per day, and a cold store of up to 300 tonnes. It handles its own customs and transit procedures for the export of fish products, primarily targeting European and Chinese markets.

Industry: Seafood Processing & Export (Fishing & Aquaculture)
Address: Majunga (Mahajanga), Madagascar

Attack summary

Severity: high — The group has published five data archives containing confirmed exfiltrated data including personnel records (potential PII), visa documents, and operational business data; the disclosed status is 'data_published', indicating actual release rather than mere listing.

The Cyclops ransomware group claims to have exfiltrated data from Pêchexport and has published multiple data archives, including files related to visa records, personnel information, operational tracking, fiscal/tax reporting on fish, and armament/fleet records.

high

Data the group says was taken

AI dossier — extracted from the leak post

Visa documents
Personnel records
Operational tracking/follow-up records (2023)
Fish tax/IR state programme documents
Fleet/armament records

The group's post references roughly 5 proof files.

What the group claims

Infrastructure and logistics Pêchexport is located in Majunga on a surface of 8400 m². Our premises include offices, a factory, a laboratory, storage equipment and technical workshops. We have a fleet of eight freezer trawlers, two refrigerated trucks and a fleet of vehicles transporting our products upstream.Hygiene and quality We have eight EU and CIQ (The China entry-exit Inspection and Quarantine Bureau) certified refrigerated trawlers. We have a CE-approved fish processing plant, with its HACCP (Hazard Analysis Critical Control Point) approach, a treatment capacity of 5t/day and a cold store that can store up to 300 tons. We have our own bacteriological and physico-chemical analysis laboratory approved by the Institut Pasteur. All our products are systematically tested before each shipment to guarantee the best quality to our customers.Autonomous customs procedures To facilitate the export of our products, we carry out customs procedures ourselves through our transit service autonomously and efficiently.Data:======https://anonfiles.com/d9Iemaz3z4/VISA_ziphttps://anonfiles.com/VeD7i5z8za/SUIVI_2023_ziphttps://anonfiles.com/V6Lei3zdz1/PERSONNEL_ziphttps://anonfiles.com/edN3ibzazb/PROGRAMME_ETABLIR_ETAT_IR_POISSON_ziphttps://anonfiles.com/s2Qci9z0z3/ARMEMENT_zip

Sources

Victim sitepechexport.mg

Source

Indexed 3 years ago

This page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.