D1r Ransomware
TrackedThreat actor group tracked in the global ransomware database · Last disclosure: Jul 13, 2026
ThreatAI Analysis
Compiled from the ransomware.live profile for D1r and from this database. Figures and technique mappings are quoted from the source data, not inferred.
Who D1r is
D1R Claims Synopsys and Bosch Breaches, but Synopsys Disputes Intrusion
Recorded activity
Disclosures attributed to D1r in this database run from July 2026 to July 2026, totalling 3 victims — 0% of everything tracked here. D1r has listed victims in 3 countries in this database, most often United States, followed by United Kingdom and Germany. The sectors appearing most in its listings are Technology, Manufacturing.
How D1r is documented to operate
Valid Accounts T1078 Stealth Persistence
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network.
Mitigations: Application Developer Guidance, User Training, Password Policies, User Account Management, Privileged Account Management, Multi-factor Authentication
MITRE ATT&CK reference →Exploit Public-Facing Application T1190 Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration. Exploited applications are often websites/web servers, but can also include databases (like SQL), standard services (like SMB or SSH), network device administration and management protocols (like SNMP and Smart Install), and any other system with Internet-accessible open sockets. On ESXi infrastructure, adversaries may exploit exposed OpenSLP services; they may alternatively exploit exposed VMware vCenter servers.
Mitigations: Vulnerability Scanning, Limit Access to Resource Over Network, Filter Network Traffic, Network Segmentation, Privileged Account Management, Application Isolation and Sandboxing
MITRE ATT&CK reference →Multi-Factor Authentication Interception T1111 Credential Access
Adversaries may target multi-factor authentication (MFA) mechanisms, (i.e., smart cards, token generators, etc.) to gain access to credentials that can be used to access systems, services, and network resources. Use of MFA is recommended and provides a higher level of security than usernames and passwords alone, but organizations should be aware of techniques that could be used to intercept and bypass these security mechanisms. If a smart card is used for multi-factor authentication, then a keylogger will need to be used to obtain the password associated with a smart card during normal use.
Mitigations: User Training
MITRE ATT&CK reference →Steal or Forge Authentication Certificates T1649 Credential Access
Adversaries may steal or forge certificates used for authentication to access remote systems or resources. Digital certificates are often used to sign and encrypt messages and/or files. Certificates are also used as authentication material. For example, Entra ID device certificates and Active Directory Certificate Services (AD CS) certificates bind to an identity and can be used as credentials for domain accounts. Authentication certificates can be both stolen and forged. For example, AD CS certificates can be stolen from encrypted storage (in the Registry or files), misplaced certificate files (i.e.
Mitigations: Audit, Active Directory Configuration, Disable or Remove Feature or Program, Encrypt Sensitive Information
MITRE ATT&CK reference →Data from Information Repositories T1213 Collection
Adversaries may leverage information repositories to mine valuable information. Information repositories are tools that allow for storage of information, typically to facilitate collaboration or information sharing between users, and can store a wide variety of data that may aid adversaries in further objectives, such as Credential Access, Lateral Movement, or Defense Evasion, or direct access to the target information. Adversaries may also abuse external sharing features to share sensitive documents with recipients outside of the organization (i.e., Transfer Data to Cloud Account).
Mitigations: User Training, Out-of-Band Communications Channel, User Account Management, Multi-factor Authentication, Software Configuration, Audit
MITRE ATT&CK reference →Data from Cloud Storage T1530 Collection
Adversaries may access data from cloud storage. Many IaaS providers offer solutions for online data object storage such as Amazon S3, Azure Storage, and Google Cloud Storage. Similarly, SaaS enterprise platforms such as Office 365 and Google Workspace provide cloud-based document storage to users through services such as OneDrive and Google Drive, while SaaS application providers such as Slack, Confluence, Salesforce, and Dropbox may provide cloud storage solutions as a peripheral or primary use case of their platform.
Mitigations: Filter Network Traffic, User Account Management, Restrict File and Directory Permissions, Multi-factor Authentication, Audit, Encrypt Sensitive Information
MITRE ATT&CK reference →Automated Exfiltration T1020 Exfiltration
Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection. When automated exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as Exfiltration Over C2 Channel and Exfiltration Over Alternative Protocol.
MITRE ATT&CK reference →Exfiltration Over C2 Channel T1041 Exfiltration
Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.
Mitigations: Network Intrusion Prevention, Data Loss Prevention
MITRE ATT&CK reference →Exfiltration Over Alternative Protocol T1048 Exfiltration
Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. Alternate protocols include FTP, SMTP, HTTP/S, DNS, SMB, or any other network protocol not being used as the main command and control channel. Adversaries may also opt to encrypt and/or obfuscate these alternate channels. Exfiltration Over Alternative Protocol can be done using various common operating system utilities such as Net/SMB or FTP. On macOS and Linux <codecurl</code may be used to invoke protocols such as HTTP/S or FTP/S to exfiltrate data from a system.
Mitigations: Network Intrusion Prevention, Filter Network Traffic, Data Loss Prevention, Network Segmentation, User Account Management, Restrict File and Directory Permissions
MITRE ATT&CK reference →Exfiltration Over Web Service T1567 Exfiltration
Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise. Firewall rules may also already exist to permit traffic to these services. Web service providers also commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Mitigations: Restrict Web-Based Content, Data Loss Prevention
MITRE ATT&CK reference →MITRE ATT&CK techniques attributed to D1r across its recorded activity. They describe the group overall, not any single incident.
Threat Actor Analysis
D1r is a ransomware threat group that has disclosed 3 victims in publicly accessible leak site data, representing 0% of all ransomware attacks tracked in this database. The earliest victim disclosure attributed to D1r in our dataset dates to July 2026.
Geographically, D1r has targeted organisations in 3 countries. The most frequently targeted nation is United States with 1 victim organisations. Other heavily targeted nations include United Kingdom, Germany.
Industry-wise, D1r shows a concentration in the Technology, Manufacturing sectors. These industries are frequently targeted because they manage sensitive data, critical operations, or have lower tolerance for operational downtime — conditions that increase ransom payment likelihood.
Like most modern ransomware operations, D1r likely employs a double extortion model: encrypting victim files while simultaneously exfiltrating data, creating dual pressure to pay the ransom. Victim organisations that refuse payment face having their data published on the group's dark web leak site.
Note: This profile is generated from public leak site disclosures aggregated via the ransomware.live API. Data is updated automatically. The table below lists the 3 most recent of the 3 disclosures we hold for this group; use the link beneath it to page through all of them.
Recent Victim Disclosures (showing 3 of 3)
| # | Organization | Country | Sector | Date |
|---|---|---|---|---|
| 1 | ARM arm.com | 🇬🇧 United Kingdom | Technology | Jul 13, 2026 |
| 2 | Bosch bosch.de | 🇩🇪 Germany | Manufacturing | Jul 13, 2026 |
| 3 | Synopsys Synopsys.Com | 🇺🇸 United States | Technology | Jul 13, 2026 |
Frequently Asked Questions
What is D1r ransomware?
D1r is a ransomware threat group that has claimed 3 victims since its first known activity in July 2026. The group operates by infiltrating target networks, exfiltrating data, encrypting files, and threatening to publish stolen data on a dark web leak site if the ransom is not paid.
How many victims has D1r attacked?
D1r has claimed 3 victims in our database, representing 0% of all tracked ransomware attacks. The most targeted countries are United States, United Kingdom, Germany.
Which countries does D1r target?
D1r has attacked organizations in 3 countries. The top targeted countries are: United States, United Kingdom, Germany.
Which industries does D1r target?
D1r most frequently targets the Technology, Manufacturing sectors based on victim disclosures in our database.
Is D1r still active?
D1r's most recent victim disclosure in our database was on July 13, 2026. Ransomware groups frequently rebrand or go dormant; monitor this page and our ransomware map for the latest activity.