Dysphor1a
| Active
Suspicious group. We did not manage to confirm any victims.
Victims
11
First Victim
2026-08-20
(est. attack date)
Discovery Date
2026-08-20
Last Seen
2026-09-06
Inactive Since
15
days
Avg Delay
N/A
attack→claim
Infostealer
87.5%
victims with domain
Countries
5
hit
Uptime
78.6% avg (30d)
Attack Velocity — Last 12 months (based on attack estimated date if available)
-62% vs last month
Known Locations (3)
| Favicon | Title | Type | Available | Last Visit | Server Info | FQDN | Status | |
|---|---|---|---|---|---|---|---|---|
|
Chrome Dino Game | Yes | 2026-09-21T17:33:46 | Surge |
normalhunters0x.surge.sh
|
|||
|
DYSPHOR1A Ransomware Group | No | 2026-09-21T17:32:48 |
y3maveiwszbnrziufbbberx74cvrdcsf72nxzuqxzv7ppdmmqzffazid.onion
|
||||
|
DNS Resolution Error - Domain Not Found, Or Domain not added to hosting account | Yes | 2026-09-21T17:34:37 | nginx |
null.yzz.me
|
Target
Top 5 Activity Sectors
- Education 3
- Government & Defense 2
- Financial Services 2
- Technology 2
- Transportation 1
Top 5 Countries
-
Myanmar
6
-
Thailand
2
-
France
1
-
India
1
-
Indonesia
1
Heatmap
Indicators of Compromise (IoCs) (1)
Telegram
1
| Type | IOC |
|---|---|
Telegram
|
jacudeez
|
Victims (11)
Road Transport Administration Department (RTAD) — official government portal providing public transp…
Citizens Pay (also known as CTZPay) is a mobile digital wallet and payment platform in Myanmar power…
Myanmar Broadband Telecom Co., Ltd. (MBT) is a leading fiber internet service provider and telecommu…
Netim is a French domain name registrar and web hosting provider. Full compromise of internal system…
Yoma Fleet is a leading vehicle operating lease, rental, and financing company based in Yangon, Myan…
The University of Delhi (DU) is a major public university in New Delhi, India, founded in 1922. It i…
Leaked data from AYUDHYA (TH Insurance / Allianz Thailand). Internal batch-control system used withi…
Compromised user accounts from GUSTO College's GLMS (Global Learning Management System). Exposed use…
Database containing records of 52,000 Indonesian police officers including email addresses, phone nu…
Normal Hunters operation compromising Job Net .COM.MM business data, exposing corporate information,…
Normal Hunters operation compromising Strategy First International College (SFIC) student accounts, …