Loading threat actor…
D1R is a financially motivated cybercriminal extortion group identified in July 2026 and described as an emerging ransomware actor. It operates a Tor-based data leak site and threatens to publish allegedly stolen corporate information unless ransom demands are met. Its publicly named targets include Synopsys, Bosch, and ARM, spanning semiconductor design, technology, and engineering manufacturing in the United States, Germany, and the United Kingdom. D1R's documented activity centers on leak-site listings and data-disclosure threats. Its allegations of compromising Synopsys and obtaining Bosch intellectual property remain unsubstantiated: Synopsys stated that its investigation found no evidence of unauthorized access to its data or customer technical information, and Bosch did not confirm a breach. Material presented as evidence included a document matching publicly available information. Actual data theft, the claimed exploitation methods, and deployment of file-encrypting ransomware have not been independently established.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
12 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
3 indicators attributed to this actor. Values are masked here and available in full in Mallory.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.