Ransomware Group intelligence
Direwolf
ActiveTrack Direwolf with 252 published victims and 1 known leak locations in a single intelligence view.
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
Direwolf is tracked by Breach House as a ransomware group with 252 published victims.
United States is currently the most targeted country in this dataset.
1 known leak locations are currently associated with this group.
Leak Status Distribution
252
- Leaked 116 46.0%
- Pending 135 53.6%
- Deleted 1 0.4%
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (1)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 1 | Onion service | Up checked 4h ago | direwolfcdkv5whaz2spehizdg22jsuf5aeje4asmetpbt6ri4jnd4qd.onion |
Top Activity Sectors (16)
- Manufacturing / Engineering 40
- Services 35
- Finance / Legal / Insurance 30
- IT 24
- Healthcare / Pharma 21
- Transportation / Travel / Logistics 14
- Construction / Real Estate 12
- Communication / Marketing 11
- Retail / E-commerce 10
- Not identified 9
- Agriculture / Food 7
- Education 6
- Telecommunications 3
- Public Sector 2
- Energy 2
- Hospitality / Food & Beverage / Tourism 2
Typical Attacks (10)
▼MITRE ATT&CK does not currently catalogue Direwolf, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: direwolf executes PowerShell scripts to stage payloads and manipulate system processes before encryption.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
T1106 Native API Execution
What they do: direwolf leverages native API calls to interact with Windows services and evade detection during lateral movement.
What that means: Adversaries may interact with the native OS application programming interface (API) to execute behaviors.
-
What they do: direwolf adds malicious registry run keys to ensure persistence across reboots on compromised hosts.
What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: direwolf disables antivirus tools and security software using registry modifications and service interference.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1070.004 File Deletion Stealth
What they do: direwolf deletes Volume Shadow Copies and backup folders via vssadmin and command-line tools to prevent recovery.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1018 Remote System Discovery Discovery
What they do: direwolf performs remote system discovery via Nmap scans to map network topology before deploying ransomware.
What that means: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.
-
T1083 File and Directory Discovery Discovery
What they do: direwolf discovers files and directories using Windows Explorer APIs to identify critical data for encryption.
What that means: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
-
T1021.002 SMB/Windows Admin Shares Lateral Movement
What they do: direwolf moves laterally through SMB shares to access additional systems within the victim network.
What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
-
T1486 Data Encrypted for Impact Impact
What they do: direwolf encrypts victim files using custom symmetric encryption routines targeting business documents and backups.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1490 Inhibit System Recovery Impact
What they do: direwolf halts critical system recovery processes and service restarts to maximize operational disruption.
What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
Ransom Notes (1)
▼The note this group leaves on a compromised machine. Click a filename to read it.
HowToRecoveryFiles.txt
Dear Mr or Ms,
If you are reading this message, it means that:
- your network infrastructure has been compromised
- critical data was leaked
- We decrypted your encrypted files. The anti-leakage system is useless to us. We can provide proof.
- files are encrypted
--------------------------------------------------------------------------
The best and only thing you can do is to contact us
to settle the matter before any losses occurs.
--------------------------------------------------------------------------
We can maintain confidentiality for 3 days for you, during which we will not disclose any information about your intrusion or data leakage.
We can extend the confidentiality period free of charge until we reach an agreement if you contact us within 3 days and communicate effectively with us.
If the confidentiality period expires, we will disclose the relevant information.
We provide complimentary decryption testing services. For specific details, please contact us.
--------------------------------------------------------------------------
We have provided a sample document as proof of our possession of your files and you can download and check it:
- https://gofile.io/d/[snip]
Please be advised that your files are scheduled for public release after 30 working days.
If you want to secure your files, we urge you to reach out to us at your earliest convenience.
--------------------------------------------------------------------------
Contact Details:
- live chat room:
- url:http://direwolf3ddtab5anvhulcelauvoxu2a7l264hqs6vtxtgrqsjfvodid.onion/
- roomID: [snip]
- username: [snip]
- password: [snip]
--------------------------------------------------------------------------
Our official website:
- url:http://direwolfcdkv5whaz2spehizdg22jsuf5aeje4asmetpbt6ri4jnd4qd.onion/
--------------------------------------------------------------------------
How to access .onion website:
1.Download and install TOR Browser https://torproject.org
2.Open it and try to access our onion address
3.Maybe you need to use VPN if it can not open our onion address
Ransom-note text from RansomLook, licensed CC BY 4.0.
Victims (252)
Search, filter and paginate the victim timeline for Direwolf. Showing 101–200 of 252.
| Type | Target | Discovered | Country | Business Category | Intel Link | Leak status |
|---|---|---|---|---|---|---|
| Ransomware | 🇨🇱 Hospital Clnico Universidad de Chile id33966 View details | Chile | Healthcare / Pharma | leaked | ||
|
🇨🇱 Hospital Clnico Universidad de Chile Published: 2026-08-30 Company: Hospital Clnico Universidad de Chile Website: https://www.redclinica.cl/ Industry: Hospitals GDPR: No Data Size: 240GB Read More → Ended |
||||||
| Ransomware | 🇹🇷 Erdem Hospital id33967 View details | Türkiye | Manufacturing / Engineering | pending | ||
|
🇹🇷 Erdem Hospital Published: 2026-08-30 Company: Erdem Hospital Website: https://www.erdemhastahanesi.com.tr/ Industry: Hospitals GDPR: No Data Size: 260GB Read More → Ended |
||||||
| Ransomware | 🇦🇹 THQ Nordic id33968 View details | United States | Other | pending | ||
|
🇦🇹 THQ Nordic Published: 2026-08-30 Company: THQ Nordic Website: https://thqnordic.com/ Industry: Multimedia,Games,Graphics Software GDPR: Yes Data Size: 335GB Read More → Ended |
||||||
| Ransomware | 🇮🇹 Studio Legale ESE id33969 View details | Italy | Finance / Legal / Insurance | pending | ||
|
🇮🇹 Studio Legale ESE Published: 2026-08-25 Company: Studio Legale ESE Website: https://studiolegaleese.it/ Industry: Law Firms , Legal Services GDPR: Yes Data Size: 420GB Read More → Ended |
||||||
| Ransomware | 🇬🇧 Studee id33970 View details | United States | Education | leaked | ||
|
🇬🇧 Studee Published: 2026-08-21 Company: Studee Website: https://studee.com Industry: - GDPR: No Data Size: 51G Read More → Ended |
||||||
| Ransomware | 🇬🇧 Reviso Cloud Accounting Limited id33971 View details | Brazil | Services | pending | ||
|
🇬🇧 Reviso Cloud Accounting Limited Published: 2026-08-21 Company: Reviso Cloud Accounting Limited Website: https://www.reviso.com Industry: - GDPR: No Data Size: 55G Read More → Ended |
||||||
| Ransomware | 🇦🇪 MCT Group of Companies id33972 View details | United Arab Emirates | Services | leaked | ||
|
🇦🇪 MCT Group of Companies Published: 2026-08-21 Company: MCT Group of Companies Website: https://www.mctuae.com Industry: Building Materials GDPR: No Data Size: 20G Read More → Ended |
||||||
| Ransomware | 🇺🇸 HP Carriers id33973 View details | United States | Transportation / Travel / Logistics | leaked | ||
|
🇺🇸 HP Carriers Published: 2026-08-21 Company: HP Carriers Website: https://www.hpcarriers.com Industry: - GDPR: No Data Size: 50G Read More → Ended |
||||||
| Ransomware | 🇺🇸 Allstar Industries id33974 View details | United States | Services | leaked | ||
|
🇺🇸 Allstar Industries Published: 2026-08-21 Company: Allstar Industries Website: https://www.allstarindustries.com Industry: Business Services GDPR: No Data Size: 50G Read More → Ended |
||||||
| Ransomware | 🇺🇸 Deer Creek-Mackinaw CUSD id33975 View details | United States | Education | leaked | ||
|
🇺🇸 Deer Creek-Mackinaw CUSD Published: 2026-08-21 Company: Deer Creek-Mackinaw CUSD Website: https://www.deemack.org Industry: Education GDPR: No Data Size: 1G Read More → Ended |
||||||
| Ransomware | 🇦🇪 iSON XPERIENCES id33976 View details | United States | Services | leaked | ||
|
🇦🇪 iSON XPERIENCES Published: 2026-08-21 Company: iSON XPERIENCES Website: https://www.isonxperiences.com Industry: Business Services GDPR: No Data Size: 300G Read More → Ended |
||||||
| Ransomware | 🇺🇸 Diaco Global id33977 View details | United States | Manufacturing / Engineering | leaked | ||
|
🇺🇸 Diaco Global Published: 2026-08-21 Company: Diaco Global Website: https://www.diacoglobal.com Industry: Jewelry & Watch Retail GDPR: No Data Size: 80G Read More → Ended |
||||||
| Ransomware | 🇬🇧 Authenticate Information Systems id33978 View details | United States | IT | leaked | ||
|
🇬🇧 Authenticate Information Systems Published: 2026-08-21 Company: Authenticate Information Systems Website: https://www.authenticateis.com Industry: - GDPR: No Data Size: 20G Read More → Ended |
||||||
| Ransomware | 🇵🇹 ProSim Aviation Research id33979 View details | United States | IT | leaked | ||
|
🇵🇹 ProSim Aviation Research Published: 2026-08-21 Company: ProSim Aviation Research Website: https://prosim.aero Industry: Engineering Software GDPR: No Data Size: 20G Read More → Ended |
||||||
| Ransomware | 🇬🇧 The Revel Collective id33980 View details | United States | Hospitality / Food & Beverage / Tourism | pending | ||
|
🇬🇧 The Revel Collective Published: 2026-08-21 Company: The Revel Collective Website: https://www.therevelcollective.com Industry: Hospitality GDPR: No Data Size: 700G Read More → Ended |
||||||
| Ransomware | Interseguro id33810 View details | Peru | — | pending | ||
|
Insurance |
||||||
| Ransomware | Softruck id33443 View details | Brazil | Transportation / Travel / Logistics | pending | ||
|
Software |
||||||
| Ransomware | Port of Tanjung Pelepas id32758 View details | Malaysia | Telecommunications | pending | ||
|
Marine Shipping & Transportation |
||||||
| Ransomware | RelyComply AML Platform id32714 View details | United Kingdom | IT | pending | ||
|
Financial Software |
||||||
| Ransomware | Sales Boomerang id32690 View details | United States | Services | pending | ||
|
Accounting/Finance Software, Analytics & Performance Software, Customer Relationship Management |
||||||
| Ransomware | EMS1R id32686 View details | United States | IT | pending | ||
|
Corporate Wellness Services |
||||||
| Ransomware | Precision Vehicle Logistics id32646 View details | United States | Transportation / Travel / Logistics | pending | ||
|
Freight & Logistics Services |
||||||
| Ransomware | TrainMe id32642 View details | Colombia | Education | leaked | ||
|
Corporate Wellness Services |
||||||
| Ransomware | Lightcast id32636 View details | United States | IT | pending | ||
|
Human Resources Software |
||||||
| Ransomware | Semper Laser id32634 View details | Sweden | Manufacturing / Engineering | pending | ||
|
Spa and Salon Management · Florida |
||||||
| Ransomware | eAssist Dental Solutions id32619 View details | United States | Services | pending | ||
|
Healthcare |
||||||
| Ransomware | myLaurel id32614 View details | United States | Healthcare / Pharma | pending | ||
|
Elderly Care Services |
||||||
| Ransomware | Mission Pet Health id32610 View details | United States | Healthcare / Pharma | leaked | ||
|
Healthcare Services |
||||||
| Ransomware | Wolfram Research id32585 View details | United States | IT | leaked | ||
|
[AI generated] Wolfram Research is an American technology and software company founded in 1987 by Stephen Wolfram and headquartered in Champaign, Illinois. It operates in the computational software and artificial intelligence industry, best known for developing Mathematica, a powerful technical computing platform, and Wolfram Alpha, a computational knowledge engine. The company also produces the Wolfram Language, used widely in scientific research, education, and data analysis. |
||||||
| Ransomware | Cartrack Holdings id32432 View details | South Africa | Transportation / Travel / Logistics | pending | ||
|
Software |
||||||
| Ransomware | PTT Oil and Retail Business id32430 View details | Thailand | IT | pending | ||
|
Chemicals |
||||||
| Ransomware | Oportunidados id32405 View details | Brazil | Retail / E-commerce | leaked | ||
|
Business Services |
||||||
| Ransomware | Honeycomb Programs Inc id32402 View details | United States | Finance / Legal / Insurance | pending | ||
|
Insurance |
||||||
| Ransomware | PT Intraco Penta Tbk id32403 View details | Indonesia | Manufacturing / Engineering | pending | ||
|
Industrial Machinery & Equipment |
||||||
| Ransomware | THQ Nordic id32314 View details | Sweden | IT | leaked | ||
|
Multimedia,Games,Graphics Software |
||||||
| Ransomware | Erdem Hospital id32315 View details | Türkiye | Manufacturing / Engineering | leaked | ||
|
Hospitals |
||||||
| Ransomware | Hospital Clnico Universidad de Chile id32316 View details | Chile | Healthcare / Pharma | pending | ||
|
Hospitals |
||||||
| Ransomware | National Kidney Registry id32119 View details | United States | Healthcare / Pharma | deleted | ||
|
[AI generated] The National Kidney Registry is a nonprofit organization based in the United States that facilitates kidney paired donation programs. It operates within the healthcare and organ transplantation industry, connecting kidney donors and recipients across a national network of transplant centers. Its mission is to improve transplant outcomes, increase the number of living donor transplants, and reduce patient waiting times for compatible kidneys. |
||||||
| Ransomware | Studio Legale ESE id32120 View details | Italy | Finance / Legal / Insurance | pending | ||
|
Law Firms , Legal Services |
||||||
| Ransomware | NorthStar id31929 View details | Canada | — | pending | ||
|
Enterprise Resource Planning |
||||||
| Ransomware | Aztec Software id31930 View details | Mexico | — | pending | ||
|
Engineering Software |
||||||
| Ransomware | The Revel Collective id31931 View details | United States | — | pending | ||
|
Hospitality |
||||||
| Ransomware | ProSim Aviation Research id31932 View details | Netherlands | — | pending | ||
|
Engineering Software |
||||||
| Ransomware | Authenticate Information Systems id31933 View details | United States | — | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | Diaco Global id31934 View details | — | pending | |||
|
Jewelry & Watch Retail |
||||||
| Ransomware | iSON XPERIENCES id31935 View details | Mexico | — | pending | ||
|
Business Services |
||||||
| Ransomware | Deer Creek-Mackinaw CUSD id31936 View details | United States | — | leaked | ||
|
Education |
||||||
| Ransomware | Allstar Industries id31937 View details | United States | — | leaked | ||
|
Business Services |
||||||
| Ransomware | HP Carriers id31938 View details | United States | — | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | MCT Group of Companies id31939 View details | United Arab Emirates | — | pending | ||
|
Building Materials |
||||||
| Ransomware | Reviso Cloud Accounting Limited id31940 View details | Denmark | — | pending | ||
|
[AI generated] Reviso Cloud Accounting Limited is a software company that provides cloud-based accounting solutions primarily targeting small and medium-sized businesses. The platform offers tools for bookkeeping, invoicing, financial reporting, and VAT management. The company operates within the financial technology and accounting software industry and is based in the United Kingdom, serving businesses seeking accessible and scalable online accounting services. |
||||||
| Ransomware | Studee id31941 View details | — | leaked | |||
|
[AI generated] Studee is an online platform that helps international students find and apply to universities around the world. Operating in the education technology industry, the company is based in the United Kingdom. It connects prospective students with hundreds of universities globally, offering guidance on courses, applications, and admissions processes, making higher education more accessible to students seeking to study abroad. |
||||||
| Ransomware | Photon Health, Inc. id31917 View details | United States | — | leaked | ||
|
Healthcare |
||||||
| Ransomware | InfoFlo CRM id31918 View details | United States | — | leaked | ||
|
software provider |
||||||
| Ransomware | PayUp id31919 View details | — | leaked | |||
|
Financial Software |
||||||
| Ransomware | Lifesum id31920 View details | Sweden | — | pending | ||
|
Hospitals & Physicians Clinics |
||||||
| Ransomware | Arizona State University (ASU) id31789 View details | United States | — | leaked | ||
|
Colleges,Universities |
||||||
| Ransomware | Wishfully Studios id31790 View details | Sweden | — | leaked | ||
|
Games |
||||||
| Ransomware | Mighty Kingdom id31792 View details | Australia | — | leaked | ||
|
Multimedia, Games |
||||||
| Ransomware | Eva AI Limited id31793 View details | United Kingdom | — | leaked | ||
|
Human Resources |
||||||
| Ransomware | DodoPayments id31741 View details | India | Finance / Legal / Insurance | leaked | ||
|
Financial Software |
||||||
| Ransomware | AAM:HOA Management id31742 View details | United States | Finance / Legal / Insurance | leaked | ||
|
HOA Management |
||||||
| Ransomware | TOTVS id31743 View details | Brazil | Services | leaked | ||
|
Business Services |
||||||
| Ransomware | Colla Health id31744 View details | United States | Healthcare / Pharma | leaked | ||
|
Healthcare |
||||||
| Ransomware | PayrHealth id31745 View details | United States | — | pending | ||
|
Healthcare |
||||||
| Ransomware | DXS International id31746 View details | United Kingdom | Healthcare / Pharma | leaked | ||
|
Healthcare |
||||||
| Ransomware | Leafwell id31553 View details | United States | Healthcare / Pharma | pending | ||
|
Hospitals & Physicians Clinics |
||||||
| Ransomware | BigSpark id31549 View details | Anguilla | IT | pending | ||
|
Business Services |
||||||
| Ransomware | Chat Jurídico id31547 View details | Brazil | Finance / Legal / Insurance | pending | ||
|
Law Firms & Legal Services |
||||||
| Ransomware | Merge id31548 View details | United States | Finance / Legal / Insurance | pending | ||
|
Financial |
||||||
| Ransomware | Swyft Inc. id31544 View details | United States | Retail / E-commerce | pending | ||
|
Retail Technology & SaaS |
||||||
| Ransomware | AliveCor, Inc. id31536 View details | United States | Healthcare / Pharma | pending | ||
|
medical device and artificial intelligence |
||||||
| Ransomware | Statista GmbH id31537 View details | Germany | IT | pending | ||
|
Data Collection & Internet Portals |
||||||
| Ransomware | Quironsalud id31538 View details | Spain | Healthcare / Pharma | leaked | ||
|
Hospitals & Physicians Clinics |
||||||
| Ransomware | Health Carousel id31539 View details | Philippines | Healthcare / Pharma | pending | ||
|
Business Services · Ohio |
||||||
| Ransomware | Fondo id31540 View details | Finance / Legal / Insurance | pending | |||
|
Financial Software |
||||||
| Ransomware | Osmo Wallet id31541 View details | United States | Finance / Legal / Insurance | pending | ||
|
FinTech |
||||||
| Ransomware | Jewelex id29811 View details | Cyprus | Retail / E-commerce | pending | ||
|
Manufacturing |
||||||
| Ransomware | Clínica Vida id29812 View details | Brazil | Healthcare / Pharma | pending | ||
|
Healthcare Services |
||||||
| Ransomware | Did Asia id29813 View details | Thailand | Manufacturing / Engineering | pending | ||
|
Automotive Parts |
||||||
| Ransomware | Nueva Pescanova Group id29814 View details | Spain | Agriculture / Food | pending | ||
|
Food & Beverage |
||||||
| Ransomware | Tepco-Group id25483 View details | Japan | Services | leaked | ||
|
Electronics |
||||||
| Ransomware | Perdana Petroleum Berhad id25482 View details | Malaysia | Energy | pending | ||
|
Energy, Utilities & Waste |
||||||
| Ransomware | Chemsain Konsultant Sdn Bhd id25481 View details | Malaysia | Manufacturing / Engineering | pending | ||
|
Architecture, Engineering & Design |
||||||
| Ransomware | Bauerfeind id25399 View details | Germany | Manufacturing / Engineering | pending | ||
|
Manufacturing |
||||||
| Ransomware | Mohammad Omar Bin Haider Holding Group id25398 View details | United Arab Emirates | Services | pending | ||
|
Business Services |
||||||
| Ransomware | Hydrodiseño id25280 View details | Spain | Manufacturing / Engineering | leaked | ||
|
Manufacturing |
||||||
| Ransomware | Bina Darulaman Berhad id25279 View details | Malaysia | Manufacturing / Engineering | pending | ||
|
Civil Engineering Construction |
||||||
| Ransomware | PernelMedia id25278 View details | France | Communication / Marketing | pending | ||
|
Media |
||||||
| Ransomware | KwikLedgers id25277 View details | United States | Finance / Legal / Insurance | pending | ||
|
Finance |
||||||
| Ransomware | Laurenzano Logistics id25276 View details | United States | Transportation / Travel / Logistics | pending | ||
|
Logistics Services |
||||||
| Ransomware | Sunzen Biotech Berhad id25275 View details | Malaysia | IT | pending | ||
|
Manufacturing |
||||||
| Ransomware | Varimed Medikal id25274 View details | Türkiye | Manufacturing / Engineering | pending | ||
|
Manufacturing |
||||||
| Ransomware | Polaris Parks id24996 View details | United States | Construction / Real Estate | pending | ||
|
Real Estate |
||||||
| Ransomware | Ranger Investigation Guard id24995 View details | Thailand | Services | pending | ||
|
Business Services |
||||||
| Ransomware | Office of Public Sector Anti-Corruption Commission id24994 View details | Thailand | Public Sector | leaked | ||
|
Government |
||||||
| Ransomware | Guan Chong Berhad id24993 View details | Malaysia | Hospitality / Food & Beverage / Tourism | pending | ||
|
Food & Beverage |
||||||
| Ransomware | Sanyang Motor id24992 View details | Taiwan, Province of China | Manufacturing / Engineering | pending | ||
|
Manufacturing |
||||||
| Ransomware | Adnan Sundra & Low id24991 View details | Malaysia | Finance / Legal / Insurance | pending | ||
|
Law Firms, Legal Services |
||||||
| Ransomware | K.M. Packaging id24249 View details | Thailand | Manufacturing / Engineering | pending | ||
|
Manufacturing |
||||||