direwolf Ransomware Group

Key insights

• •Gains initial access through spear-phishing, exploitation of exposed services, or weak credentials.
• •Employs a double extortion model, exfiltrating data before encryption and threatening to publish it.
• •Ransomware payload is written in Golang and often uses UPX for obfuscation.
• •Uses Curve25519 for key exchange and ChaCha20 for file encryption.
• •Targets include a variety of sectors with reported ransom demands reaching up to $500,000.