Cyber Threat Actor: ThySavi0r

The threat actor is known by the alias ThySavi0r.
Another alias used by the same individual is Savio.
Public sources indicate that the actor's location is Israel.
These identifiers appear in various online handles associated with the actor.

On February 24, 2015, the actor collaborated with another online user.
The collaborator is known by the handle @anonf8.
@anonf8 is affiliated with the hacking group #8bitCrew.
Together they gained unauthorized access to the website hemda.org.il.
The domain hemda.org.il uses the .il top-level domain, which is associated with Israel.
The breach resulted in the exfiltration of a user database.
The database contained 1,324 usernames.
Accompanying the usernames were the corresponding passwords stored in clear text.
The actor and collaborator subsequently released this credential dump publicly.

This incident represents the only publicly documented operation attributed to ThySavi0r/Savio.
No additional campaigns or malware families have been linked to the actor in open sources.
Consequently, the actor's known tactics are limited to web‑site intrusion and credential dumping.
Further details about the actor's affiliations, objectives, or capabilities remain unspecified in available reporting.
Thus the profile is confined to the confirmed facts outlined above.