Direwolf
Dire Wolf is a recently emerged double-extortion ransomware group that first appeared around May 2025. It is a crypto-ransomware and data broker targeting industries like manufacturing and technology across multiple countries, including the U.S., Thailand, Taiwan, Singapore, Türkiye, among others. Written in Go and delivered as a UPX-packed binary, it utilizes robust encryption (Curve25519 and ChaCha20) to lock files with a .direwolf extension, while deleting backups, disabling logging, and terminating key services to block recovery. Victims receive highly customized ransom notes containing live-chat credentials and victim-specific portals, indicating a highly professional and targeted approach.
Most affected countries
- United States8
- Chile1
- Germany1
- Spain1
- United Kingdom1
- Brazil1
- Italy1
- Malaysia1
Most affected sectors
- Other19
- Technology16
- Healthcare12
- Transport & logistics3
- Media & entertainment2
- Finance & insurance2
- Legal2
- Education2
Recent victims
| Organisation | Country | Sector | Claimed | Status |
|---|---|---|---|---|
| 🔒 Entidad sin clasificar | — | Other | 9/14/2026 | ◌ Claimed (unverified) |
| Hazel Health | — | Healthcare | 9/14/2026 | ◌ Claimed (unverified) |
| Port of Tanjung Pelepas | Malaysia | Transport & logistics | 9/11/2026 | ◌ Claimed (unverified) |
| RelyComply AML Platform | — | Technology | 9/9/2026 | ◌ Claimed (unverified) |
| 🔒 Entidad comercial | — | Other | 9/9/2026 | ◌ Claimed (unverified) |
| 🔒 Entidad sin clasificación clara | — | Other | 9/8/2026 | ◌ Claimed (unverified) |
| 🔒 Entidad de sector no determinado | — | Other | 9/7/2026 | ◌ Claimed (unverified) |
| Precision Vehicle Logistics | — | Transport & logistics | 9/7/2026 | ◌ Claimed (unverified) |
| Lightcast | — | Other | 9/7/2026 | ◌ Claimed (unverified) |
| 🔒 Entidad sin información suficiente | — | Other | 9/7/2026 | ◌ Claimed (unverified) |
| eAssist Dental Solutions | — | Healthcare | 9/6/2026 | ◌ Claimed (unverified) |
| Mission Pet Health | — | Healthcare | 9/6/2026 | ◌ Claimed (unverified) |
| myLaurel | — | Other | 9/6/2026 | ◌ Claimed (unverified) |
| Wolfram Research | United States | Technology | 9/4/2026 | ◌ Claimed (unverified) |
| Cartrack Holdings | — | Technology | 9/2/2026 | ◌ Claimed (unverified) |
| PTT Oil and Retail Business | — | Energy & utilities | 9/2/2026 | ◌ Claimed (unverified) |
| Honeycomb Programs Inc | — | Technology | 9/1/2026 | ◌ Claimed (unverified) |
| PT Intraco Penta Tbk | Indonesia | Other | 9/1/2026 | ◌ Claimed (unverified) |
| 🔒 Entidad no identificada | — | Other | 9/1/2026 | ◌ Claimed (unverified) |
| THQ Nordic | Sweden | Media & entertainment | 8/30/2026 | ◌ Claimed (unverified) |
| Erdem Hospital | — | Healthcare | 8/30/2026 | ◌ Claimed (unverified) |
| Hospital Clínico Universidad de Chile | Chile | Healthcare | 8/30/2026 | ◌ Claimed (unverified) |
| National Kidney Registry | United States | Healthcare | 8/25/2026 | ◌ Claimed (unverified) |
| Studio Legale ESE | Italy | Legal | 8/25/2026 | ◌ Claimed (unverified) |
| 🔒 Entidad no identificada | — | Other | 8/21/2026 | ◌ Claimed (unverified) |
Claims are published by the criminal groups themselves and are unverified until the organisation or the press confirms them. Names of natural persons (sole traders, individual professionals) are anonymised under the GDPR. We never link to leak sites or stolen data. To request the removal or anonymisation of an entry, contact the site administrator.
Sources: RansomLook (CC BY 4.0), MITRE ATT&CK®, MISP Galaxy, Google News.