← All ransomware groups

Ransomware group profile · #203 by claimed victims

DYSPHOR1A ransomware

Suspicious group. We did not manage to confirm any victims.

Active First seen Aug 2026

11Victims claimed on leak sites

11Victims in the last 30 days

11Victims in the last 90 days

5Countries hit

2Leak-site URLs tracked, 1 online

6 Sep 2026Latest claim recorded

Victimology

Who DYSPHOR1A claims to have breached, from 11 leak-site posts recorded by VULONE.

Claims per month last 12 months

Top sectors

Education3

Financial Services2

Technology2

Government & Defense2

Transportation1

Professional Services1

Top countries

Myanmar6

Thailand2

France1

India1

Indonesia1

Latest claimed victims 11 most recent

Victim	Sector	Country	Claimed
RTAD GOV MM rtad.gov.mm	Government & Defense	MM	6 Sep 2026
CitizensPay ctzpay.com	Financial Services	MM	5 Sep 2026
MBT Telecom mbt.com.mm	Technology	MM	4 Sep 2026
Netim Company netim.com	Technology	FR	23 Aug 2026
Yoma Fleet yomafleet.com	Transportation	MM	21 Aug 2026
The University of Delhi (DU) du.ac.in	Education	IN	20 Aug 2026
AYUDHYA TH Insurance	Financial Services	TH	20 Aug 2026
GUSTO College GLMS gusto-education.com	Education	TH	20 Aug 2026
Indonesian Police Database	Government & Defense	ID	20 Aug 2026
Job Net .COM.MM job net .com.mm	Professional Services	MM	20 Aug 2026
Strategy First International College strategyfirst.edu.mm	Education	MM	20 Aug 2026

All 11 DYSPHOR1A victims, searchable

Full victim list with claim posts, domains, timing and exports, plus the negotiation chats and leak-site screenshots VULONE archives for this crew.

Start free Sign in

Tactics, techniques and procedures

ATT&CK technique mapping for DYSPHOR1A is in progress. Victimology, infrastructure status and leak-site tracking are live above.

Indicators, detections and the full playbook

Hashes, C2 addresses, onion services, Sigma and YARA detections per technique, and the negotiation transcripts are available to signed-in analysts.

See full IOCs

Frequently asked

Is DYSPHOR1A ransomware still active?

DYSPHOR1A is tracked as active. The most recent leak-site claim VULONE recorded is dated 6 September 2026. 11 victims were claimed in the last 30 days.

How many victims has DYSPHOR1A claimed?

VULONE has recorded 11 leak-site victim claims attributed to DYSPHOR1A since August 2026, across 5 countries and 6 sectors.

Which industries does DYSPHOR1A target?

The sectors most often named on the DYSPHOR1A leak site are Education, Financial Services, Technology.

Which countries are most affected by DYSPHOR1A?

Most DYSPHOR1A victims recorded by VULONE are located in Myanmar, Thailand, France.

Where does VULONE get DYSPHOR1A victim data?

Claims are collected continuously from the group's own leak sites and cross-checked with ransomware.live and RansomLook. A claim is the group's assertion, not a confirmed breach.

Other ransomware groups

Victim claims are collected from leak sites and enrichment partners (ransomware.live, RansomLook) and represent the group's own assertions, not confirmed breaches. Profile last updated 16 September 2026. Questions or corrections: [email protected].