DYSPHOR1A

DYSPHOR1A is a ransomware-linked threat actor associated with multiple 2026 intrusions affecting organizations in South and Southeast Asia. Reported victims include entities in India, Myanmar, Thailand, and Indonesia across education, financial services, professional services, and government or law-enforcement environments. The actor has been tied to incidents involving both ransomware claims and data-breach activity, indicating an operational pattern centered on theft and exposure of sensitive information in addition to disruptive intrusion.

Observed DYSPHOR1A activity includes compromise of user and student accounts, exposure of credentials, theft of personal information, academic records, financial data, business operations data, and law-enforcement personnel records, and leakage of administrative access data. Reported victims include universities and colleges, an insurance-related organization, a professional services platform, and an Indonesian police database. In several cases, the activity was explicitly characterized as a data breach alongside ransomware, and some incidents were described as a "Normal Hunters operation," suggesting either an operational label, campaign name, or affiliate-style branding associated with the actor's activity.

Based on the reported victimology and outcomes, DYSPHOR1A demonstrates capabilities consistent with initial access, credential theft, exfiltration, and extortion-oriented ransomware operations. The available reporting supports a financially motivated actor focused on monetizing stolen data and ransomware pressure rather than espionage or destructive objectives. No high-confidence attribution to a specific nation-state or country of origin is currently available.