Loading threat actor…
dreamer8000 is a threat actor handle associated with public claims of data-breach activity and apparent extortion-style exposure through a forum post linked to a dedicated leak blog page. The actor has been observed alleging the theft and publication risk of sensitive corporate information from a manufacturing victim, including customer data, internal communications, contractual documents, technical documentation, and confidential engineering-related materials. This behavior is consistent with data-theft extortion operations that rely on public shaming or leak-site pressure rather than confirmed ransomware deployment. High-confidence reporting currently supports only limited attribution and victimology. The observed targeting includes an Austrian manufacturer of heavy-duty agricultural trailers and transport equipment, indicating interest in industrial and manufacturing organizations and the exfiltration of commercially sensitive information. No reliable evidence in the available facts establishes a nation-state affiliation, broader campaign history, or additional aliases beyond the handle dreamer8000.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
1 distinct technique observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.