🏹 ciphbit — Ransomware
CiphBit is a ransomware-as-a-service group active since April 2023, targeting small-to-mid-sized businesses across the UK, Europe, and North America with 38 known victims, employing a data-broker model with selective free leaks to pressure victims alongside standard double extortion.
Classification
Ransomware
Leak-site victims
36
Ransomware.live
Associated IoCs
0
local intel
MITRE techniques
—
ATT&CK
Tracked
Yes
Ransomware.live
🔥 Leak-Site Victims (36)
| Victim | Country | Published | Domain |
|---|---|---|---|
| Become Affiliate | 2026-02-10T18:18:26.387614+00:00 | ciphbitqyg26jor7eeo6xieyq7reouctefrompp6ogvhqjba7uo4xdid.onion | |
| Affiliate | 2026-02-10T16:47:03.081574+00:00 | ciphbitqyg26jor7eeo6xieyq7reouctefrompp6ogvhqjba7uo4xdid.onion | |
| Clínica Villa Zaita | PA | 2025-12-02T01:11:16.588665+00:00 | clinicavillazaita.com |
| Church of the Ascension Anglican | US | 2025-11-26T14:12:28.735174+00:00 | ascensionlondon.com |
| Jimfor, S.A. | ES | 2025-10-28T05:11:55.430830+00:00 | jimfor.com |
| Peppermint Properties | GB | 2025-10-20T13:42:12.241835+00:00 | peppermintproperties.ca |
| Corneilhan | FR | 2025-10-20T13:41:41.953735+00:00 | www.corneilhan.fr |
| Bader Gruppe | DE | 2025-09-29T14:40:35.350888+00:00 | badergruppe.com |
| António Belém & António Gonçalve | PT | 2025-09-24T23:49:49.173318+00:00 | www.abag-sroc.pt |
| Kitevuc - Equipamentos E Veiculo | BR | 2025-09-24T23:49:42.754308+00:00 | www.kitevuc.com |
| iptelecom GmbH | DE | 2025-05-27T14:48:44.770175+00:00 | www.iptelecom.at |
| Therma Seal Insulation Systems | US | 2025-02-12T19:17:52.012089+00:00 | thermaseal.net |
| Kitevuc - Equipamentos E Veiculos Utilitários E Comerciais | PT | 2025-01-01T15:16:36.710722+00:00 | kitevuc.com |
| António Belém & António Gonçalves | PT | 2024-12-13T17:53:10.668587+00:00 | abag-sroc.pt |
| AXEON 360 | FR | 2024-11-13T16:46:11.048620+00:00 | axeon-360.com |
| CopySmart LLC | US | 2024-10-04T14:58:41.347539+00:00 | copysmart.us |
| Southern Fire Sprinkler | US | 2024-09-28T15:02:10.168939+00:00 | southernfiresprinkler.com |
| Luigi Convertini | IT | 2024-08-21T13:52:31.761355+00:00 | luigiconvertini.it |
| Keios Development Consulting | IT | 2024-08-16T20:58:31.321228+00:00 | keios.it |
| FD S.R.L | IT | 2024-08-15T21:24:58.233717+00:00 | fdsrl.it |
| TrueNet Communications Corp | US | 2024-04-17T14:34:57.575425+00:00 | truenetcommunications.com |
| Macuz | IT | 2024-04-09T07:43:52.438462+00:00 | macuz.it |
| TermoPlastic S.R.L | IT | 2024-04-06T05:51:11.404558+00:00 | termoplastic.it |
| Commerce Dental Group | US | 2024-04-05T04:22:28.690496+00:00 | commercedentistry.com |
| Pot O’ Gold Coffee | US | 2024-02-25T19:18:27.872188+00:00 | potogoldcoffee.com |
| MPM Medical Supply | US | 2024-01-02T01:08:45.513941+00:00 | mpmmedicalsupply.com |
| NeoDomos | FR | 2023-11-08T00:57:14.898689+00:00 | neodomos.fr |
| APERS | 2023-11-03T23:34:59.815706+00:00 | apers13.com | |
| TransTerra | NL | 2023-09-16T17:33:53.301161+00:00 | transterra.nl |
| Marston Domsel | DE | 2023-09-16T14:54:51.374034+00:00 | marston-domsel.com |
| Harmonic Accounting | 2023-09-14T16:00:14.836103+00:00 | harmonicteam.com | |
| Imperador S.R.L | RO | 2023-09-14T16:00:13.856774+00:00 | imperadorlogistics.com |
| Waterford Retirement Residence | 2023-09-14T16:00:12.967456+00:00 | waterfordretirement.com | |
| Shelly Engineering Metal Work | GB | 2023-09-14T16:00:11.964646+00:00 | shelleyengineering.co.uk |
| RSV Centrale Bvba | BE | 2023-09-14T16:00:11.321066+00:00 | rsv-centrale.be |
| Soprovise | FR | 2023-09-14T16:00:10.340301+00:00 | soprovise.fr |
Source: Ransomware.live leak-site monitoring (cached, offline-safe).
🏹 Campaigns & malware
🧩 Advanced Capabilities
Live group profile & victims via Ransomware.live; ATT&CK technique hints are a static reference for well-known groups. All network calls cached & offline-safe.
Workstation · Copilot · AI Skills · Automation · Playbooks · Lookups · Docs · Reports
🤖 AI Copilot
⚡ AI Skills
🔍 Lookup & Enrich
📚 Docs & Reports
💡 Recommendations
- Explore related tools below
- Automate recurring work via cron