Dysphor1a
New Group | Active
This is an emerging group, so claims should be treated with caution until independently verified.
Suspicious group. We did not manage to confirm any victims.
Victims
11
First Victim
2026-08-20
(est. attack date)
Discovery Date
2026-08-20
Last Seen
2026-09-06
Inactive Since
3
days
Avg Delay
N/A
attack→claim
Infostealer
87.5%
victims with domain
Countries
5
hit
Uptime
92.1% avg (30d)
Attack Velocity — Last 12 months (based on attack estimated date if available)
-62% vs last month
Known Locations (3)
| Favicon | Title | Type | Available | Last Visit | Server Info | FQDN | Status | |
|---|---|---|---|---|---|---|---|---|
|
DYSPHOR1A Ransomware Group | No | 2026-09-09T16:07:28 | Surge |
normalhunters0x.surge.sh
|
|||
|
DYSPHOR1A Ransomware Group | No | 2026-09-09T16:07:51 |
y3maveiwszbnrziufbbberx74cvrdcsf72nxzuqxzv7ppdmmqzffazid.onion
|
||||
|
// members | Yes | 2026-09-09T16:10:02 | openresty |
null.yzz.me
|
Target
Top 5 Activity Sectors
- Education 3
- Government & Defense 2
- Financial Services 2
- Technology 2
- Transportation 1
Top 5 Countries
-
Myanmar
6
-
Thailand
2
-
France
1
-
India
1
-
Indonesia
1
Heatmap
Indicators of Compromise (IoCs) (1)
Telegram
1
| Type | IOC |
|---|---|
Telegram
|
t.me/jacudeez
|
Victims (11)
Road Transport Administration Department (RTAD) — official government portal providing public transp…
Citizens Pay (also known as CTZPay) is a mobile digital wallet and payment platform in Myanmar power…
Myanmar Broadband Telecom Co., Ltd. (MBT) is a leading fiber internet service provider and telecommu…
Netim is a French domain name registrar and web hosting provider. Full compromise of internal system…
Yoma Fleet is a leading vehicle operating lease, rental, and financing company based in Yangon, Myan…
The University of Delhi (DU) is a major public university in New Delhi, India, founded in 1922. It i…
Leaked data from AYUDHYA (TH Insurance / Allianz Thailand). Internal batch-control system used withi…
Compromised user accounts from GUSTO College's GLMS (Global Learning Management System). Exposed use…
Database containing records of 52,000 Indonesian police officers including email addresses, phone nu…
Normal Hunters operation compromising Job Net .COM.MM business data, exposing corporate information,…
Normal Hunters operation compromising Strategy First International College (SFIC) student accounts, …