Ransomware group profile · #57 by claimed victims

Direwolf ransomware

Dire Wolf is a sophisticated human-operated ransomware group first documented in May 2025, written in Golang using Curve25519/ChaCha20 encryption, targeting manufacturing and technology sectors across 13+ countries with ransoms up to $500,000, operated by a tight core team rather than a broad affiliate program.

Active First seen May 2025

141Victims claimed on leak sites

4Victims in the last 30 days

66Victims in the last 90 days

37Countries hit

3Leak-site URLs tracked, 1 online

29 Oct 2026Latest claim recorded

Victimology

Who Direwolf claims to have breached, from 141 leak-site posts recorded by VULONE.

Claims per month last 12 months

Top sectors

Healthcare21

Technology21

Professional Services20

Manufacturing19

Financial Services12

Transportation9

Energy & Utilities6

Other6

Top countries

United States32

Malaysia11

Thailand9

Brazil9

United Kingdom7

Turkiye5

Taiwan5

Singapore5

Latest claimed victims 12 most recent

Victim	Sector	Country	Claimed
USClaims	-	-	29 Oct 2026
GRUPO PETROIL petroil.com.mx	Energy & Utilities	MX	27 Oct 2026
Interseguro interseguro.pe	Financial Services	PE	13 Oct 2026
Softruck softruck.com	Technology	BR	4 Oct 2026
Little Otter	-	-	14 Sep 2026
Hazel Health	-	-	14 Sep 2026
Port of Tanjung Pelepas ptp.com.my	Transportation	MY	11 Sep 2026
RelyComply AML Platform relycomply.com	Financial Services	GB	9 Sep 2026
Sales Boomerang salesboomerang.com	Professional Services	US	8 Sep 2026
EMS1R ems1r.com	Not Found	US	8 Sep 2026
Precision Vehicle Logistics precisionvehiclelogistics.com	Transportation	US	7 Sep 2026
TrainMe trainme.co	Education	CO	7 Sep 2026

All 141 Direwolf victims, searchable

Full victim list with claim posts, domains, timing and exports, plus the negotiation chats and leak-site screenshots VULONE archives for this crew.

Start free Sign in

Tactics, techniques and procedures

ATT&CK technique mapping for Direwolf is in progress. Victimology, infrastructure status and leak-site tracking are live above.

Indicators, detections and the full playbook

Hashes, C2 addresses, onion services, Sigma and YARA detections per technique, and the negotiation transcripts are available to signed-in analysts.

See full IOCs

Frequently asked

Is Direwolf ransomware still active?

Direwolf is tracked as active. The most recent leak-site claim VULONE recorded is dated 29 October 2026. 4 victims were claimed in the last 30 days.

How many victims has Direwolf claimed?

VULONE has recorded 141 leak-site victim claims attributed to Direwolf since May 2025, across 37 countries and 14 sectors.

Which industries does Direwolf target?

The sectors most often named on the Direwolf leak site are Healthcare, Technology, Professional Services.

Which countries are most affected by Direwolf?

Most Direwolf victims recorded by VULONE are located in United States, Malaysia, Thailand.

Where does VULONE get Direwolf victim data?

Claims are collected continuously from the group's own leak sites and cross-checked with ransomware.live and RansomLook. A claim is the group's assertion, not a confirmed breach.

Other ransomware groups

Victim claims are collected from leak sites and enrichment partners (ransomware.live, RansomLook) and represent the group's own assertions, not confirmed breaches. Profile last updated 31 October 2026. Questions or corrections: research@vulone.com.