Ransomware needs a way in. Stolen credentials are the cheapest one.
direwolf Ransomware Group
Ransomware group profile
Description
Dire Wolf is a financially motivated ransomware group that emerged in May 2025 and quickly established itself through disruptive attacks across multiple regions. The group operates a dark web leak site and employs a double extortion model, demonstrating a clear emphasis on monetary profit over any political agenda.
Key insights
- •Gains initial access through spear-phishing, exploitation of exposed services, or weak credentials.
- •Employs a double extortion model, exfiltrating data before encryption and threatening to publish it.
- •Ransomware payload is written in Golang and often uses UPX for obfuscation.
- •Uses Curve25519 for key exchange and ChaCha20 for file encryption.
- •Targets include a variety of sectors with reported ransom demands reaching up to $500,000.
Threat Level & Status Breakdown
For direwolf · Based on incidents in selected period
Status Breakdown
Recent activity
Monthly attack count for direwolf in the selected period
Intelligence
IOCs, YARA/Sigma rules, and related families for direwolf
- aa62b3905be9b49551a07bc16eaad2ff
- 27d90611f005db3a25a4211cf8f69fb46097c6c374905d7207b30e87d296e1b3
- 4a5852e9f9e20b243d8430b229e41b92949e4d69
- 7d589f794115171949fa2a7e3b66dcd4
- acd02a4f8b25e9106400e0a3af63a760
- b6fa7a34b57803d2b80f3f484656d34997231597b6c1aa7fc8a386d6474c8afe
- f0a85f105fa178ffa862bd3fdbc6b7ec642dd46189a10e14786c802fac8978e9
- 50b0567a6974721085f4d2baf2b5104e329a6a2e
- 2337edd0fcdb8e1587aff10766ebc16e93df3304
- 333fd9dd9d84b58c4eef84a8d07670dd
- bc6912c853be5907438b4978f6c49e43
- 44da29144b151062bce633e9ce62de85
- 31fe32bddd2bd4b825e355516d852476
- a482d7e61ba199cbe005a549249894ba
- 3b97927cde6c906f6b6f03797c21efa7
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for direwolf
T1486
T1486
T1490
T1490
T1021
T1021
T1562
T1562
T1078
T1078
T1021.001
T1021.001
T1547
T1547
T1059
T1059
T1047
T1047
T1489
T1489
Victims(96)
| Company | Country | Status | Discovered | |
|---|---|---|---|---|
| Little Otter | — | Claimed | 10 days ago | |
| Hazel Health | — | Claimed | 10 days ago | |
| Port of Tanjung Pelepas | Malaysia | Claimed | 14 days ago | |
| RelyComply | United Kingdom | Claimed | 16 days ago | |
| Sales Boomerang | United States | Claimed | 16 days ago | |
| EMS1R | United States | Claimed | 17 days ago | |
| Precision Vehicle Holdings | United States | Claimed | 17 days ago | |
| TrainMe | Colombia | Claimed | 18 days ago | |
| Lightcast | United States | Claimed | 18 days ago | |
| Semper Laser | Sweden | Claimed | 18 days ago | |
| eAssist Dental Billing Solutions | United States | Claimed | 19 days ago | |
| myLaurel | United States | Claimed | 19 days ago | |
| Mission Pet Health | United States | Claimed | 19 days ago | |
| Wolfram Research | United States | Claimed | 20 days ago | |
| Cartrack | South Africa | Claimed | 22 days ago | |
| PTT Oil and Retail Business | Thailand | Claimed | 23 days ago | |
| Oportunidados | Brazil | Claimed | 24 days ago | |
| PT Intraco Penta Tbk | Indonesia | Claimed | 24 days ago | |
| Honeycomb Insurance | United States | Claimed | 24 days ago | |
| Red Clínica | Chile | Claimed | 26 days ago |
Page 1 of 5
Affected countries(42)
Countries where this group has been reported to target or leak victims.