# Bosch targeted by D1R ransomware gang

Published: 2026-07-13 · Severity: routine · Sectors: manufacturing, technology
Canonical: https://vorant.io/reports/e0e62798-6e10-52e9-a9a3-c42d3a201c1b/bosch-targeted-by-d1r-ransomware-gang

> D1R ransomware operators claim compromise of Bosch with credentials for 5,626 users and exposure of third-party employee accounts.

Ransomware.live, a public tracking platform for ransomware victim claims, reports that the D1R ransomware group has claimed responsibility for a compromise of Bosch. According to the public claim, the intrusion exposed credentials for 5,626 user accounts, three third-party employee credentials, and identified 101 items in the victim's external attack surface. The claim includes DNS record enumeration suggesting reconnaissance of Bosch's network infrastructure. This appears to be a post-compromise threat claim, with the group leveraging compromised credentials and external reconnaissance data as leverage in extortion.

Defenders at Bosch and partner organizations should assume credential compromise and treat exposed employee accounts as high-priority for credential rotation and monitoring. Third-party vendors with access to Bosch systems should similarly review access logs and implement enhanced credential controls. The threat includes both direct compromise of Bosch infrastructure and potential supply-chain risk to Bosch customers and suppliers who may be targeted via trust relationships.

## Mentioned in this report

- Threat actors: D1R
- Malware: D1R

## Detection guidance (public sample)

### DNS Record Enumeration via nslookup or DNS Recon Tooling

ATT&CK: T1590.002

Detects bulk DNS enumeration (nslookup ANY/AXFR queries, ls -d zone listing, or dedicated DNS recon tools) consistent with external attack-surface mapping. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: DNS Record Enumeration via nslookup or DNS Recon Tooling
description: 'Detects bulk DNS enumeration on a host: nslookup ANY/AXFR or ls -d zone
  listing, or dedicated DNS recon tools such as dnsrecon, dnsenum, fierce. Generalises
  on the technique (record-type sweeps and zone transfer attempts), not on any victim
  domain. The report only claims DNS record enumeration, so this is a low-fidelity
  hunting rule.'
tags:
- attack.reconnaissance
- attack.t1590.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_nslookup:
    Image|endswith: \nslookup.exe
    CommandLine|contains|windash:
    - -type=any
    - -querytype=any
    - -type=axfr
    - -qt=any
    - -qt=axfr
    - ls -d
  selection_tools:
    Image|endswith:
    - \dnsrecon.exe
    - \dnsenum.exe
    - \fierce.exe
    - \dnsmap.exe
  condition: 1 of selection_*
falsepositives:
- Network or DNS administrators troubleshooting zones with nslookup ANY queries
- Authorized penetration tests or attack-surface management scans run from Windows
  hosts
level: low
id: 0aadadce-5647-5c73-8411-d2dc589be59a
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/Qm9zY2hARDFS
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

1 more detection for this report is in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://www.ransomware.live/id/Qm9zY2hARDFS

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/e0e62798-6e10-52e9-a9a3-c42d3a201c1b/bosch-targeted-by-d1r-ransomware-gang.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup