Threat actor analysis
Dysphor1a has disclosed 11 victims on its leak site, 0% of all ransomware listings tracked in this database. Its earliest disclosure here dates to August 2026.
The group has listed organisations in 5 countries, most often in Myanmar (6 victims), followed by Thailand, France, India.
By industry, its listings concentrate in Education, Government & Defense, Financial Services — sectors that hold sensitive data or cannot tolerate long outages, both of which raise the pressure to pay.
Like most current ransomware operations, Dysphor1a is likely to use double extortion: data is stolen before files are encrypted, and organisations that refuse to pay are named on the leak site with the stolen data as leverage.