direwolf
ransomware group · aka Dire Wolf, DireWolf, direwolf · unknown · active since 2025-03 (first public reporting and leak-site listings; earliest activity unknown)
Dire Wolf is a ransomware and data-extortion group first publicly reported in March 2025, operating a Tor-based leak site and using a double-extortion model of data theft plus encryption. Vendor research (notably Broadcom/Symantec in 2025) documented rapid intrusions against small and mid-sized organizations across multiple regions, with attackers using bring-your-own-vulnerable-driver (BYOVD) techniques to disable EDR and living-off-the-land tooling for discovery and staging. Attribution and the initial-access vector remain publicly unknown, and no specific CVEs have been tied to the group in available vendor reporting. This dashboard tracked 11 newly listed victims between 2026-09-04 and 2026-09-09, spanning technology, healthcare, logistics, and financial services.
- Deploys Windows ransomware combined with data theft; posts stolen data to a Tor leak site when demands are unmet (vendor and leak-site reporting, 2025)
- Uses BYOVD abuse of vulnerable signed drivers to terminate or blind EDR agents (Symantec/Broadcom, 2025)
- Living-off-the-land binaries and native Windows tools for reconnaissance and staging (vendor reporting, 2025)
- Targets primarily small and mid-sized organizations across multiple industries and regions (vendor reporting, 2025)
- Ransom notes instruct victims to contact the group for negotiation; published details of the payment channel are limited (unknown)
- Initial access vector not publicly confirmed (unknown)
Wolfram Research (leak-site listing, Sep 2026), Lightcast (leak-site listing, Sep 2026), RelyComply AML Platform (leak-site listing, Sep 2026), eAssist Dental Solutions (leak-site listing, Sep 2026), Precision Vehicle Logistics (leak-site listing, Sep 2026), Mission Pet Health (leak-site listing, Sep 2026), Pride Purple Group (reported Dire Wolf victim, 2025)
No public figure.
Leak-site victims137 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| Little Otter | · 1d ago | — |
| Hazel Health | · 1d ago | — |
| Port of Tanjung Pelepas | · 3d ago | — |
| RelyComply AML Platform | · 6d ago | — |
| Sales Boomerang | · 6d ago | — |
| EMS1R | · 7d ago | — |
| TrainMe | · 8d ago | — |
| Precision Vehicle Logistics | · 8d ago | — |
| Lightcast | · 8d ago | — |
| Semper Laser | · 8d ago | — |
| eAssist Dental Solutions | · 9d ago | — |
| Mission Pet Health | · 9d ago | — |
| myLaurel | · 9d ago | — |
| Wolfram Research | · 11d ago | — |
| Cartrack Holdings | · 13d ago | — |
| PTT Oil and Retail Business | · 13d ago | — |
| Honeycomb Programs Inc | · 14d ago | — |
| PT Intraco Penta Tbk | · 14d ago | — |
| Oportunidados | · 14d ago | — |
| THQ Nordic | · 16d ago | — |
| Erdem Hospital | · 16d ago | — |
| Hospital Clnico Universidad de Chile | · 16d ago | — |
| National Kidney Registry | · 21d ago | — |
| Studio Legale ESE | · 21d ago | — |
| NorthStar | · 25d ago | — |
| Aztec Software | · 25d ago | — |
| The Revel Collective | · 25d ago | — |
| ProSim Aviation Research | · 25d ago | — |
| Authenticate Information Systems | · 25d ago | — |
| Diaco Global | · 25d ago | — |
| iSON XPERIENCES | · 25d ago | — |
| Deer Creek-Mackinaw CUSD | · 25d ago | — |
| Allstar Industries | · 25d ago | — |
| HP Carriers | · 25d ago | — |
| MCT Group of Companies | · 25d ago | — |
| Reviso Cloud Accounting Limited | · 25d ago | — |
| Studee | · 25d ago | — |
| Photon Health, Inc. | · 27d ago | — |
| InfoFlo CRM | · 27d ago | — |
| PayUp | · 27d ago | — |
| Lifesum | · 27d ago | — |
| Mighty Kingdom | · 29d ago | — |
| Eva AI Limited | · 29d ago | — |
| Arizona State University (ASU) | · 29d ago | — |
| Wishfully Studios | · 29d ago | — |
| TOTVS | · Aug 15, 2026 | — |
| Colla Health | · Aug 15, 2026 | — |
| PayrHealth | · Aug 15, 2026 | — |
| DXS International | · Aug 15, 2026 | — |
| DodoPayments | · Aug 15, 2026 | — |
In the newsAll →
No articles mention this group yet.