Ransomware Group intelligence
Direwolf
ActiveTrack Direwolf with 141 published victims and 1 known leak locations in a single intelligence view.
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
Direwolf is tracked by Breach House as a ransomware group with 141 published victims.
United States is currently the most targeted country in this dataset.
1 known leak locations are currently associated with this group.
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (1)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 1 | Onion service | Up checked 4h ago | direwolfcdkv5whaz2spehizdg22jsuf5aeje4asmetpbt6ri4jnd4qd.onion |
Top Activity Sectors (16)
- Manufacturing / Engineering 17
- Finance / Legal / Insurance 13
- Services 11
- Communication / Marketing 10
- Healthcare / Pharma 9
- IT 7
- Not identified 7
- Retail / E-commerce 4
- Construction / Real Estate 4
- Agriculture / Food 3
- Transportation / Travel / Logistics 3
- Energy 1
- Public Sector 1
- Hospitality / Food & Beverage / Tourism 1
- Education 1
- Telecommunications 1
Typical Attacks (10)
▼MITRE ATT&CK does not currently catalogue Direwolf, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: direwolf executes PowerShell scripts to stage payloads and manipulate system processes before encryption.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
T1106 Native API Execution
What they do: direwolf leverages native API calls to interact with Windows services and evade detection during lateral movement.
What that means: Adversaries may interact with the native OS application programming interface (API) to execute behaviors.
-
What they do: direwolf adds malicious registry run keys to ensure persistence across reboots on compromised hosts.
What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: direwolf disables antivirus tools and security software using registry modifications and service interference.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1070.004 File Deletion Stealth
What they do: direwolf deletes Volume Shadow Copies and backup folders via vssadmin and command-line tools to prevent recovery.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1018 Remote System Discovery Discovery
What they do: direwolf performs remote system discovery via Nmap scans to map network topology before deploying ransomware.
What that means: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.
-
T1083 File and Directory Discovery Discovery
What they do: direwolf discovers files and directories using Windows Explorer APIs to identify critical data for encryption.
What that means: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
-
T1021.002 SMB/Windows Admin Shares Lateral Movement
What they do: direwolf moves laterally through SMB shares to access additional systems within the victim network.
What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
-
T1486 Data Encrypted for Impact Impact
What they do: direwolf encrypts victim files using custom symmetric encryption routines targeting business documents and backups.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1490 Inhibit System Recovery Impact
What they do: direwolf halts critical system recovery processes and service restarts to maximize operational disruption.
What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
Ransom Notes (1)
▼The note this group leaves on a compromised machine. Click a filename to read it.
HowToRecoveryFiles.txt
Dear Mr or Ms,
If you are reading this message, it means that:
- your network infrastructure has been compromised
- critical data was leaked
- We decrypted your encrypted files. The anti-leakage system is useless to us. We can provide proof.
- files are encrypted
--------------------------------------------------------------------------
The best and only thing you can do is to contact us
to settle the matter before any losses occurs.
--------------------------------------------------------------------------
We can maintain confidentiality for 3 days for you, during which we will not disclose any information about your intrusion or data leakage.
We can extend the confidentiality period free of charge until we reach an agreement if you contact us within 3 days and communicate effectively with us.
If the confidentiality period expires, we will disclose the relevant information.
We provide complimentary decryption testing services. For specific details, please contact us.
--------------------------------------------------------------------------
We have provided a sample document as proof of our possession of your files and you can download and check it:
- https://gofile.io/d/[snip]
Please be advised that your files are scheduled for public release after 30 working days.
If you want to secure your files, we urge you to reach out to us at your earliest convenience.
--------------------------------------------------------------------------
Contact Details:
- live chat room:
- url:http://direwolf3ddtab5anvhulcelauvoxu2a7l264hqs6vtxtgrqsjfvodid.onion/
- roomID: [snip]
- username: [snip]
- password: [snip]
--------------------------------------------------------------------------
Our official website:
- url:http://direwolfcdkv5whaz2spehizdg22jsuf5aeje4asmetpbt6ri4jnd4qd.onion/
--------------------------------------------------------------------------
How to access .onion website:
1.Download and install TOR Browser https://torproject.org
2.Open it and try to access our onion address
3.Maybe you need to use VPN if it can not open our onion address
Ransom-note text from RansomLook, licensed CC BY 4.0.
Victims (141)
Search, filter and paginate the victim timeline for Direwolf. Showing 101–141 of 141.
| Type | Target | Discovered | Country | Business Category | Intel Link |
|---|---|---|---|---|---|
| Ransomware | Purwana Group id22166 View details | Indonesia | Services | ||
|
[AI generated] N/A |
|||||
| Ransomware | Taiwan Flex Electronics id22165 View details | Taiwan, Province of China | IT | ||
|
[AI generated] Taiwan Flex Electronics Corp is a leading technology company based in Taiwan that specializes in producing and selling electronics. They focus on developing flexible electronic technology products, including flexible printed circuits. Their key areas of expertise bring the intersection of material science and electronics together, central to innovations in electronics like digital devices. They serve a broad range of industries such as automotive, computing, and consumer electronics. |
|||||
| Ransomware | Aroeira Salles Advogados id21929 View details | Brazil | Finance / Legal / Insurance | ||
|
[AI generated] Aroeira Salles Advogados is a Brazilian law firm providing a comprehensive array of legal services. Their expertise covers a range of disciplines such as labor law, public law, civil law, business law, and environmental law. Established in 2001, the firm serves both individuals and corporations and is known for its commitment to ethical and effective legal practice. Aroeira Salles prides itself on its use of technology for driving efficiency in legal services. |
|||||
| Ransomware | Bolt Nut Manufacturing id21928 View details | United Kingdom | Manufacturing / Engineering | ||
|
[AI generated] Bolt Nut Manufacturing is a dedicated company involved in manufacturing and delivering superior quality bolt nuts for various industries. The company specializes in creating high-strength, durable bolt nuts using best-in-class materials. They serve clientele from diverse industries, providing reliable solutions that meet specific needs. Their commitment to quality, prompt delivery, and customer service sets them apart. |
|||||
| Ransomware | Dynacast id21927 View details | United States | Manufacturing / Engineering | ||
|
[AI generated] Dynacast is a global manufacturing company specializing in engineered metal components. It provides solutions using precision die casting, metal injection molding, and CNC machining. It caters to various sectors including automotive, healthcare, and consumer electronics. Established in 1936, Dynacast operates more than 20 manufacturing facilities in over a dozen countries. |
|||||
| Ransomware | 台灣東洋國際儀表股份有限公司 id21926 View details | Taiwan, Province of China | Other | ||
|
[AI generated] N/A |
|||||
| Ransomware | Wine Works Australia id21925 View details | Australia | Communication / Marketing | ||
|
[AI generated] Wine Works Australia is a wine sales and marketing company that represents local and international wineries in export markets. They focus on establishing sustainable and profitable relationships with business partners. The company uses its extensive knowledge of wine and international markets to develop effective strategies to drive wine sales in different regions. They offer services to wineries seeking to start or expand their export operations. |
|||||
| Ransomware | International Freight & Commerce id21809 View details | Tunisia | Retail / E-commerce | ||
|
[AI generated] N/A |
|||||
| Ransomware | Avv Emilio Marco Casali id21735 View details | Italy | Other | ||
|
[AI generated] N/A |
|||||
| Ransomware | Immigration Advice Service id21734 View details | United Kingdom | Services | ||
|
[AI generated] The Immigration Advice Service (IAS) is a UK-based legal firm specializing in immigration issues. It assists with various immigration matters such as visa applications, citizenship, asylum, business immigration, and more. It has a team of expert immigration lawyers who offer advice and services to individuals, families, and businesses. IAS also provides services globally with several offices in different countries. |
|||||
| Ransomware | ksubsea-group id21733 View details | Norway | Services | ||
|
[AI generated] N/A |
|||||
| Ransomware | HCK Capital Group id21537 View details | Malaysia | Communication / Marketing | ||
|
[AI generated] HCK Capital Group is a Malaysian investment holding company, primarily operating in the fields of property development, education, and media. Founded by Tan Sri Clement Hii, the group invests in potential high-growth sectors, particularly in consumer-driven businesses, seeking unique market opportunities to maximize capital growth. |
|||||
| Ransomware | Kingsford Development & LEADBUILD Construction Pte Ltd id21536 View details | Singapore | Construction / Real Estate | ||
|
[AI generated] N/A |
|||||
| Ransomware | MGI Singapore PAC id21404 View details | Singapore | Services | ||
|
[AI generated] MGI Singapore PAC is a Singapore-based accounting firm providing comprehensive services to clients worldwide. Part of the MGI Worldwide CPAAI, a global accounting network, MGI Singapore PAC offers financial, tax, corporate and business advisory solutions. They cater to various industries including construction, educators/ training providers, engineering, real estate, hospitality, etc. |
|||||
| Ransomware | W.L. FOODS id21403 View details | Philippines | Agriculture / Food | ||
|
[AI generated] W.L. Foods is a prominent food manufacturing and distribution company in the Philippines. It was founded in 1986 and quickly gained fame for its production of high-quality food products, especially in the snack food category. They offer a range of products like biscuits, wafers, candies, chocolates, pretzels, and drinks. W.L. Foods also exports its products to several countries across North America, Europe, Middle East, and Asia. |
|||||
| Ransomware | Acarlar Ltd id21402 View details | Türkiye | Services | ||
|
[AI generated] N/A |
|||||
| Ransomware | Universidad Mayor id21251 View details | Chile | Education | ||
|
Universidad Mayor (UM), acreditación institucional con la Middle States Commission on Higher Education de los EE.UU (MSCHE). |
|||||
| Ransomware | Anadolu Hastaneleri id21250 View details | Türkiye | Healthcare / Pharma | ||
|
Anadolu Hospitals strives to become the preferred brand in the region with its experienced healthcare staff. |
|||||
| Ransomware | Pergamon Status Diş Ticaret A Ş id21249 View details | Türkiye | Other | ||
|
Pergamon Status Diş Ticaret A Ş is a company that operates in the international trade industry. |
|||||
| Ransomware | Akribis Systems id21248 View details | Singapore | Services | ||
|
Akribis Systems is a global designer and manufacturer of direct drive motors, stages, positioning systems. |
|||||
| Ransomware | Doak Shirreff Lawyers id21066 View details | Canada | Finance / Legal / Insurance | ||
|
Doak Shirreff Kelowna Lawyers is a full-service law firm situated in Kelowna, British Columbia. |
|||||
| Ransomware | UPG Enterprises id21065 View details | United States | Communication / Marketing | ||
|
UPG Enterprises is a privately held operator of industrial companies that focus on steel, lamination, rail products and metal-wares. |
|||||
| Ransomware | MITACHI (HK) COMPANY LIMITED id21064 View details | Hong Kong | Services | ||
|
Mitachi (Hk) Company Limited is headquartered in Hong Kong. Subsidiary of Japan's MITACHI CO., LTD. |
|||||
| Ransomware | INICIA id21063 View details | Dominican Republic | Communication / Marketing | ||
|
Inicia Ltd specializes in providing a range of poultry-related products and services. |
|||||
| Ransomware | Faria Braga Advogados Associados id21062 View details | Brazil | Finance / Legal / Insurance | ||
|
Faria Braga Advogados Associados is a society of environmental and urban law, working with public bodies company based out of R Paraiba, 1323, 4° Andar, Savassi, Belo Horizonte, MG Brazil. |
|||||
| Ransomware | THAIRUNG GROUP id20722 View details | Thailand | Telecommunications | ||
|
Thairung Group is a leading group of companies in the automobile business. |
|||||
| Ransomware | GB Group id20721 View details | United Kingdom | Communication / Marketing | ||
|
GBGroup is in the process of developing innovative solutions for their clients. |
|||||
| Ransomware | K.M. Packaging Co., Ltd id20557 View details | Thailand | Manufacturing / Engineering | ||
|
K.M. Packaging Public Company Limited is a company specializing in the production of food and beverage packaging. |
|||||
| Ransomware | Medifarma id20556 View details | Peru | Agriculture / Food | ||
|
The leading pharmaceutical laboratory in Peru, present in eight countries and with more than 3,600 employees. |
|||||
| Ransomware | Health-Insights id20555 View details | Malaysia | Healthcare / Pharma | ||
|
A worldwide leading, reliable, highest performance and most cost effective HCIT (HealthCare Information Technology) services provider. |
|||||
| Ransomware | YIEH UNITED STEEL CORP id20445 View details | Taiwan, Province of China | Manufacturing / Engineering | ||
|
Yieh United Steel Corp is a company that operates in the Minerals & Mining industry |
|||||
| Ransomware | IoTechWorld id20444 View details | India | IT | ||
|
IoTechWorld Avigation, India's largest drone manufacturer, aims to transform agriculture with advanced drones. |
|||||
| Ransomware | EPC Group id20443 View details | United States | Manufacturing / Engineering | ||
|
The EPC Group is an internationally active engineering and plant construction company as well as a provider of innovative technologies. |
|||||
| Ransomware | Bin Faqeeh Real Estate id20363 View details | Bahrain | Construction / Real Estate | ||
|
Kingdom of Bahrain’s leading real estate investment company. |
|||||
| Ransomware | TDM Technical Services id20362 View details | Canada | IT | ||
|
TDM Technical Services provides the best human resources available, on an as needed contract basis. |
|||||
| Ransomware | DataPost id20270 View details | Singapore | Communication / Marketing | ||
|
DataPost Pte Ltd is a leading provider of secured data handling solutions based in Singapore, specializing in e-invoicing and data privacy services. |
|||||
| Ransomware | kiwi86 id20269 View details | Taiwan, Province of China | Communication / Marketing | ||
|
Provide 'fair' and 'professional': [Insurance Product Database] and related [Policy: Physical Examination and Management] system services |
|||||
| Ransomware | qualitas-pro id20268 View details | Italy | Communication / Marketing | ||
|
Qualitas Commercialisti Associati is an association of Chartered Accountants able to offer consultancy and assistance in corporate, fiscal, contractual, pre-bankruptcy and bankruptcy matters. |
|||||
| Ransomware | SMV Thailand id20267 View details | Thailand | Manufacturing / Engineering | ||
|
Wilson International is a global commodities trading company specializing in the supply chain for fertilizer and petrochemical manufacturing facilities. |
|||||
| Ransomware | Wilson International id20266 View details | India | Manufacturing / Engineering | ||
|
Wilson International is a global commodities trading company specializing in the supply chain for fertilizer and petrochemical manufacturing facilities. |
|||||
| Ransomware | Legal Practice Board of Western Australia id20265 View details | Australia | Finance / Legal / Insurance | ||
|
[AI generated] The Legal Practice Board of Western Australia is an independent statutory body established under the Legal Profession Act of 2008. Its mission is to control the admission, registration, and discipline of lawyers in Western Australia. It approves the rules of conduct for legal practitioners and institutes legal disciplinary action when necessary. The board also oversees areas like continuing professional development and the managed trust accounts of law firms. |
|||||