Ransomware.live: D1R

Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

| Active

D1R Claims Synopsys and Bosch Breaches, but Synopsys Disputes Intrusion

Victims

3

First Discovered

2026-07-13

victim

Last Discovered

2026-07-13

victim

Inactive Since

9

days

Avg Delay

N/A

attack→claim

Infostealer

100.0%

victims with domain

Countries

3

hit

View Victims on World Map View Group Statistics

Attack Velocity — Last 12 months

3 victims this month

Known Locations (1)

Favicon	Title	Type	Available	Last Visit	Server Info	FQDN
	Items – D1R		Yes	2026-07-22T21:11:03	nginx 1.22.1 — PHP 8.2.12	`dirone3rl3vvq64ckcnrvhe2ogrhjrwu5u7hqzrlotu3rfvmqmmbsuqd.onion/items`

Target

Heatmap

TTPs Matrix (8)

This information is provided by Crocodyli & Ransomware.live
Initial Access	Persistence	Privilege Escalation	Stealth	Credential Access	Collection	Exfiltration	Impact
Valid Accounts	Valid Accounts	Valid Accounts	Valid Accounts	Multi-Factor Authentication Interception	Data from Information Repositories	Automated Exfiltration	Data Encrypted for Impact
Exploit Public-Facing Application				Steal or Forge Authentication Certificates	Data from Cloud Storage	Exfiltration Over C2 Channel	Financial Theft
						Exfiltration Over Alternative Protocol
						Exfiltration Over Web Service

Indicators of Compromise (IoCs) (2)

telegram 1 tox 1

Type	IOC
`telegram`	`https://t.me/Qqqqqqops`
`tox`	`063719AF013AD4EE89B497701BA5916898D70F45543C39E41154C4BCAC3A2F26F57913B31431`

Victims (3)

Bosch

Discovered: 2026-07-13 (9d ago)

Again, thanks to database Synopsys provided us with After analyzing technical leaks by other groups …

ARM

Discovered: 2026-07-13 (9d ago)

Thanks to leaked database by Synopsys, a roadmap was provided Many other group leaks were cross-refe…

Discovered: 2026-07-13 (9d ago)

Data, Leak…