Loading story…
The D1R extortion group claimed it breached Synopsys and used information from that access to target customers including Bosch and Arm. Posts attributed to the group alleged theft of a Synopsys corporate client database containing roughly 40,000 entries, access to Bosch engineering-related material including a claimed CAN module implementation, and the download of Arm’s Athena Download Manager. The attackers also asserted that leaked Synopsys data and third-party access paths helped them identify and pursue additional victims, while saying Arm’s repeated 2FA prompts slowed but did not stop their activity.
Synopsys said its investigation found no evidence of unauthorized access to its systems or customer technical data, and stated the threat actor had not contacted the company. Reporting also cast doubt on D1R’s proof-of-compromise claims: a screenshot presented as evidence of Bosch data exposure appeared to match a publicly available Bosch user manual, and Bosch did not confirm any breach, issuing only a general statement on its cybersecurity posture. The competing claims leave the alleged downstream exposure of Synopsys customers unverified, even as D1R attempts to pressure multiple high-profile firms with breach and leak assertions.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
SecurityWeek reported that Bosch did not confirm a breach after D1R alleged it had obtained Bosch intellectual property through Synopsys. Bosch responded only with a general statement emphasizing its cybersecurity posture.
SecurityWeek reported that Synopsys said its investigation found no evidence of unauthorized access to its systems or customer technical data after D1R's claims. The company also said the threat actor had not contacted it.
A HookPhish report said ARM was identified as a victim of a ransomware-related breach attributed to D1R. The incident was explicitly stated as discovered on July 13, 2026, and the attackers alleged they used Synopsys-leaked data to gain access and download the Athena Download Manager.
A HookPhish report said Bosch was a victim of a ransomware-related data breach attributed to D1R. The incident was explicitly stated as discovered on July 13, 2026, with attackers alleging access tied to technical leaks and possible third-party compromise.
A HookPhish report said Synopsys was identified as a victim of a ransomware-related data breach attributed to D1R. The incident was explicitly stated as discovered on July 13, 2026 at 11:32 UTC.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
teiss.co.uk
Open sourcescworld.com
Open sourcemalware.news
Open sourcesecurityweek.com
Open sourcehookphish.com
Open sourcehookphish.com
Open sourcehookphish.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Mexican IT and cybersecurity provider **Be Prime** disclosed a cyberattack after a threat actor using the alias **`dylanmarly`** posted alleged proof of compromise on a cybercrime forum. The attacker claimed to have accessed Be Prime administrative accounts, **Cisco Meraki Vision** surveillance systems, Meraki API keys, and thousands of network devices, and to have leaked **12.6 GB** of data linked to Be Prime and some of its clients. Public reporting said the intrusion may have involved administrator accounts without multifactor authentication, though Be Prime did not confirm those specific allegations. Be Prime said it activated containment, mitigation, investigation, and remediation measures with support from **Cisco Talos**, and stated that it had found no evidence so far of disruption to its own operations or those of customers. At the same time, the company warned it could pursue legal action against parties spreading what it described as false or out-of-context claims about the incident, a response that drew criticism from researchers and journalists who argued that threatening reporters and whistleblowers could intensify scrutiny of the breach and its potential impact on client data and video surveillance exposure.
Jun 29, 2026
The hacking group **ShinyHunters** claimed to have breached the internal systems of *Resecurity*, a US-based cybersecurity firm, releasing screenshots purportedly showing access to sensitive dashboards, user management panels, API keys, employee data, and internal communications. ShinyHunters alleged they exfiltrated internal chats, client lists, threat intelligence data, and employee information, framing the attack as retaliation for Resecurity's alleged attempts to infiltrate threat actor groups by posing as buyers on dark web markets. The group also credited Devman Ransomware for assistance in the attack and published evidence to support their claims. However, *Resecurity* responded by stating that the data accessed by ShinyHunters was part of a sophisticated honeypot operation designed to monitor and log threat actor activity. According to Resecurity, the honeypot included simulated data and a planted honeytrap account, and there was no impact on actual customers or internal operations. Resecurity confirmed that all data referenced by ShinyHunters originated from the honeypot, and they had already logged the attackers' IP addresses. The incident highlights the ongoing cat-and-mouse dynamics between cybersecurity firms and threat actors, as well as the use of deception technologies in cyber defense.
Jun 29, 2026
The provided items do not describe a single cohesive cybersecurity event; they cover **separate incidents and research**. Dark Reading reported an **Iran-linked credential theft and surveillance effort** targeting people of interest abroad (including Iranian expats and regional targets) using **spear-phishing and social engineering**, including lures delivered via **WhatsApp** and phishing infrastructure that was rapidly stood up and taken down as campaigns shifted targets. Separately, Dark Reading covered allegations that the **Chronus Group** leaked **2.3TB** of data purportedly sourced from **25+ Mexican government institutions**, claiming exposure affecting **36 million** people; Mexico’s **ATDT** disputed that it represented a new breach, stating it appeared to be **aggregated data from prior incidents** and that impacted systems were largely **obsolete, third-party administered** state-level platforms. In parallel, Red Asgard published new technical findings on the **Lazarus-linked “Contagious Interview”** activity targeting **developers/freelancers** via fake recruiting, reporting recovery of **241,764 plaintext credentials** from unauthenticated endpoints, identification of an **AnyDesk-based RAT** with persistent remote access and hardcoded attacker credentials, and additional detection content (e.g., **YARA** and **Snort** rules).
Jun 29, 2026