Ransomware needs a way in. Stolen credentials are the cheapest one.
d1r Ransomware Group
Ransomware group profile
Description
d1r is an extortion and ransomware group that emerged in July 2026, focusing on financial gain through multi-extortion tactics. They threaten the public release of proprietary data and corporate client information if their ransom demands are not met. The group claims to exploit vulnerabilities in semiconductor software but has faced skepticism from targeted entities regarding their claims of data compromise.
Key insights
- •Employs multi-extortion tactics involving data theft and public shaming.
- •Claims to target vulnerabilities in semiconductor software providers to access downstream engineering clients.
- •Utilizes a Tor hidden service for ransom negotiations and public victim notices.
- •Targets multinational technology and engineering firms, particularly in the semiconductor and automotive sectors.
- •Relies on threats to expose sensitive hardware development documents and corporate records.
Threat Level & Status Breakdown
For d1r · Based on incidents in selected period
Status Breakdown
Recent activity
Monthly attack count for d1r in the selected period
Intelligence
IOCs, YARA/Sigma rules, and related families for d1r
- dirone3rl3vvq64ckcnrvhe2ogrhjrwu5u7hqzrlotu3rfvmqmmbsuqd.onion
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for d1r
T1562
Impair Defenses
T1046
Network Service Discovery
T1059
Command and Scripting Interpreter
T1105
Ingress Tool Transfer
T1047
Windows Management Instrumentation
T1486
Data Encrypted for Impact
T1490
Inhibit System Recovery
T1021.001
Remote Desktop Protocol
T1528
T1528
T1078
Valid Accounts
Victims(3)
Affected countries(3)
Countries where this group has been reported to target or leak victims.