Ransomware needs a way in. Stolen credentials are the cheapest one.
ciphbit Ransomware Group
Ransomware group profile
Description
CiphBit is a newly emerged ransomware group known for its sophisticated encryption techniques and aggressive tactics targeting large organizations and critical infrastructure. They utilize double-extortion methods and advanced malware to secure substantial ransom payments, often leveraging phishing and vulnerability exploitation to breach victim networks.
Key insights
- •Utilizes advanced encryption algorithms for data encryption.
- •Employs double-extortion tactics, threatening to leak data if ransom is not paid.
- •Targets large organizations and critical infrastructure sectors.
- •Gains initial access through phishing, social engineering, and exploiting vulnerabilities like CVE-2020-1472.
- •Demand ransom payments primarily in cryptocurrency.
- •Employs sophisticated evasion techniques to bypass traditional security measures.
Threat Level & Status Breakdown
For ciphbit · Based on incidents in selected period
Status Breakdown
Recent activity
Monthly attack count for ciphbit in the selected period
No intelligence data for this group.
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for ciphbit
T1486
T1486
T1490
T1490
T1021
T1021
T1562
T1562
T1078
T1078
T1059
T1059
T1547
T1547
T1021.001
T1021.001
T1080
T1080
T1203
T1203
T1046
T1046
T1588
T1588
Victims(9)
| Company | Country | Status | Discovered | |
|---|---|---|---|---|
| Become Affiliate | — | Claimed | 7 months ago | |
| Affiliate | — | Claimed | 7 months ago | |
| Clínica Villa Zaita | Panama | Claimed | 10 months ago | |
| Anglican Church of Ascension | United States | Claimed | 10 months ago | |
| JIMFOR | Spain | Claimed | 11 months ago | |
| Peppermint Properties | United Kingdom | Claimed | 11 months ago | |
| Commune de Corneilhan | France | Claimed | 11 months ago | |
| Bader Gruppe | Germany | Claimed | 12 months ago | |
| Kitevuc | Brazil | Claimed | 12 months ago |
Affected countries(36)
Countries where this group has been reported to target or leak victims.