Ciphr, Encrypted App That Served Organized Crime, Rebrands as Enterprise Software

The company behind Ciphr, an encrypted messaging platform that was especially popular among organized criminals and high tier drug traffickers, is beta testing a new app in an apparent rebrand from its long running reputation as a tech tool of the underground.

The news shows the continuing ruptures across the underground encrypted phone industry after an escalating series of law enforcement hacks and investigations. The rebrand by OnyxCorp, the company that made Ciphr, is the latest episode in that fallout. Other companies in the space have died altogether, had their founders arrested and imprisoned, and had thousands of their criminal users arrested and charged.

“There was talk of reinventing the app with a focus on enterprise customers,” a former employee told Motherboard. Motherboard granted the source anonymity because they said they had signed an NDA.

The new app is called Mode. “Privacy & Protection for Team Communication,” the app’s website reads. The website says Mode protects chats with end-to-end encryption and disappearing messages, and also includes video calling and file sharing. Sign up requires no email address or phone number, and the app can block users from copying and pasting content from inside Mode, the website adds. In essence, Mode looks like Microsoft Teams or Slack, or could be seen as a competitor to Wickr or Wire. Both of those are secure messaging apps whose paid products are geared towards organizations.

Notably, the Mode website is not available in the U.S. The FBI has been behind multiple investigations into the encrypted phone industry. In 2018 it shuttered major player Phantom Secure. Then in June 2021, the FBI revealed it had been secretly running its own encrypted phone company called Anom in order to harvest users’ messages. When visiting the Mode site from the U.S., the site returns a message: “Sorry, Mode is not available in your region.” Mode’s website is available from Canada, where OnyxCorp is based.

Beyond information from the former employee, Motherboard found Mode’s website used infrastructure connected to Ciphr and OnyxCorp domains. Motherboard analyzed passive DNS data which shows what domain was linked to a particular IP address at a point in time. Motherboard found that Mode, Ciphr, and OnyxCorp domains were all linked to the same IP address at various points.  

At the moment, Mode is advertised as only being in beta. Visitors are asked to join a waitlist for more information.

Ciphr, OnyxCorp’s earlier app, was heavily used by international drug traffickers. After the FBI shutdown of Phantom Secure, which sold modified BlackBerry devices, Ciphr became the de facto victor of the Australian encryption market, according to multiple sources inside the industry. One prolific drug trafficker who used Ciphr was known as Mr. Blonde, who escaped the subsequent Anom investigation because they used Ciphr, according to the Sydney Morning Herald. 

In the wake of mounting law enforcement investigations against the industry, including massive police hacks of rival companies Encrochat and Sky, Ciphr pulled out of the Australian market altogether, Motherboard reported in 2021. At the time, Ciphr declined to comment, and stopped responding to Motherboard’s messages.

Then last year, Ciphr said it was shutting down entirely, according to a copy of a message obtained by Motherboard. That closure brought to an end the last remaining giant of the encrypted phone industry, but the emergence of Mode means that the company behind it is showing some signs of life. 

OnyxCorp did not respond to a request for comment on the reason for the rebranding.

Subscribe to our cybersecurity podcast, CYBER. Subscribe to our new Twitch channel.