D1r
| Active
D1R Claims Synopsys and Bosch Breaches, but Synopsys Disputes Intrusion
Victims
3
First Victim
2026-07-13
(est. attack date)
Discovery Date
2026-07-13
Last Seen
2026-07-13
Inactive Since
35
days
Avg Delay
N/A
attack→claim
Infostealer
100.0%
victims with domain
Countries
3
hit
Uptime
97.5% avg (30d)
Attack Velocity — Last 12 months (based on attack estimated date if available)
Known Locations (1)
| Favicon | Title | Type | Available | Last Visit | Server Info | FQDN | |
|---|---|---|---|---|---|---|---|
|
Items – D1R | Yes | 2026-08-17T16:45:20 | nginx 1.22.1 — PHP 8.2.12 |
dirone3rl3vvq64ckcnrvhe2ogrhjrwu5u7hqzrlotu3rfvmqmmbsuqd.onion/items
|
Target
Top 5 Activity Sectors
- Technology 2
- Manufacturing 1
Top 5 Countries
-
Germany
1
-
United Kingdom
1
-
United States
1
Heatmap
TTPs Matrix (8)
| Initial Access | Persistence | Privilege Escalation | Stealth | Credential Access | Collection | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|
| Valid Accounts | Valid Accounts | Valid Accounts | Valid Accounts | Multi-Factor Authentication Interception | Data from Information Repositories | Automated Exfiltration | Data Encrypted for Impact |
| Exploit Public-Facing Application | Steal or Forge Authentication Certificates | Data from Cloud Storage | Exfiltration Over C2 Channel | Financial Theft | |||
| Exfiltration Over Alternative Protocol | |||||||
| Exfiltration Over Web Service |
Indicators of Compromise (IoCs) (3)
session
1
telegram
1
tox
1
| Type | IOC |
|---|---|
session
|
05e2640aa00bc196273e7ee81b2d3d81dd641f052229f89f1ea8bc39600c7d8648
|
telegram
|
https://t.me/Qqqqqqops
|
tox
|
063719AF013AD4EE89B497701BA5916898D70F45543C39E41154C4BCAC3A2F26F57913B31431
|
