cipherforce Ransomware Group

Key insights

• •Operates under multiple aliases including PCPcat and DeadCatx3, linked to TeamPCP.
• •Employs supply chain compromises to gain initial access, particularly targeting vulnerabilities in developer environments.
• •Utilizes proprietary ransomware with a shared RSA-4096 public key for encryption.
• •Involves credential harvesting from GitHub and npm tokens as part of its access strategy.
• •Conducts both direct ransomware attacks and broader affiliate campaigns via Vect Ransomware.
• •Data is exfiltrated and threatened for public leakage if ransom is not paid, employing a dual extortion model.
• •Utilizes a Tor-based data leak site for releasing stolen information.