Ransomware group profile · #119 by claimed victims

Ciphbit ransomware

CiphBit is a ransomware-as-a-service group active since April 2023, targeting small-to-mid-sized businesses across the UK, Europe, and North America with 38 known victims, employing a data-broker model with selective free leaks to pressure victims alongside standard double extortion.

Active First seen Sep 2023

36Victims claimed on leak sites

0Victims in the last 30 days

0Victims in the last 90 days

12Countries hit

3Leak-site URLs tracked, 1 online

10 Feb 2026Latest claim recorded

Victimology

Who Ciphbit claims to have breached, from 36 leak-site posts recorded by VULONE.

Claims per month last 12 months

Top sectors

Professional Services10

Manufacturing9

Healthcare3

Other3

Technology2

Transportation2

Financial Services2

Agriculture and Food Production1

Top countries

United States8

Italy5

France4

Germany3

Portugal3

United Kingdom2

Spain1

Brazil1

Latest claimed victims 12 most recent

Victim	Sector	Country	Claimed
Become Affiliate ciphbitqyg26jor7eeo6xieyq7reouctefrompp6ogvhqjba7uo4xdid.onion	Other	—	10 Feb 2026
Affiliate ciphbitqyg26jor7eeo6xieyq7reouctefrompp6ogvhqjba7uo4xdid.onion	Other	—	10 Feb 2026
Clínica Villa Zaita clinicavillazaita.com	Healthcare	PA	2 Dec 2025
Church of the Ascension Anglican ascensionlondon.com	Other	US	26 Nov 2025
Jimfor, S.A. jimfor.com	Manufacturing	ES	28 Oct 2025
Peppermint Properties peppermintproperties.ca	Professional Services	GB	20 Oct 2025
Corneilhan corneilhan.fr	Agriculture and Food Production	FR	20 Oct 2025
Bader Gruppe badergruppe.com	Manufacturing	DE	29 Sep 2025
António Belém & António Gonçalve abag-sroc.pt	Professional Services	PT	24 Sep 2025
Kitevuc - Equipamentos E Veiculo kitevuc.com	Manufacturing	BR	24 Sep 2025
iptelecom GmbH iptelecom.at	Technology	DE	27 May 2025
Therma Seal Insulation Systems thermaseal.net	Manufacturing	US	12 Feb 2025

All 36 Ciphbit victims, searchable

Full victim list with claim posts, domains, timing and exports, plus the negotiation chats and leak-site screenshots VULONE archives for this crew.

Start free Sign in

Tactics, techniques and procedures

ATT&CK technique mapping for Ciphbit is in progress. Victimology, infrastructure status and leak-site tracking are live above.

Indicators, detections and the full playbook

Hashes, C2 addresses, onion services, Sigma and YARA detections per technique, and the negotiation transcripts are available to signed-in analysts.

See full IOCs

Frequently asked

Is Ciphbit ransomware still active?

Ciphbit is tracked as active. The most recent leak-site claim VULONE recorded is dated 10 February 2026.

How many victims has Ciphbit claimed?

VULONE has recorded 36 leak-site victim claims attributed to Ciphbit since September 2023, across 12 countries and 12 sectors.

Which industries does Ciphbit target?

The sectors most often named on the Ciphbit leak site are Professional Services, Manufacturing, Healthcare.

Which countries are most affected by Ciphbit?

Most Ciphbit victims recorded by VULONE are located in United States, Italy, France.

Where does VULONE get Ciphbit victim data?

Claims are collected continuously from the group's own leak sites and cross-checked with ransomware.live and RansomLook. A claim is the group's assertion, not a confirmed breach.

Other ransomware groups

Victim claims are collected from leak sites and enrichment partners (ransomware.live, RansomLook) and represent the group's own assertions, not confirmed breaches. Profile last updated 16 September 2026. Questions or corrections: [email protected].