Ransomware Group intelligence
Direwolf
ActiveTrack Direwolf with 252 published victims and 1 known leak locations in a single intelligence view.
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
Direwolf is tracked by Breach House as a ransomware group with 252 published victims.
United States is currently the most targeted country in this dataset.
1 known leak locations are currently associated with this group.
Leak Status Distribution
252
- Leaked 116 46.0%
- Pending 135 53.6%
- Deleted 1 0.4%
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (1)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 1 | Onion service | Up checked 4h ago | direwolfcdkv5whaz2spehizdg22jsuf5aeje4asmetpbt6ri4jnd4qd.onion |
Top Activity Sectors (16)
- Manufacturing / Engineering 40
- Services 35
- Finance / Legal / Insurance 30
- IT 24
- Healthcare / Pharma 21
- Transportation / Travel / Logistics 14
- Construction / Real Estate 12
- Communication / Marketing 11
- Retail / E-commerce 10
- Not identified 9
- Agriculture / Food 7
- Education 6
- Telecommunications 3
- Public Sector 2
- Energy 2
- Hospitality / Food & Beverage / Tourism 2
Typical Attacks (10)
▼MITRE ATT&CK does not currently catalogue Direwolf, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: direwolf executes PowerShell scripts to stage payloads and manipulate system processes before encryption.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
T1106 Native API Execution
What they do: direwolf leverages native API calls to interact with Windows services and evade detection during lateral movement.
What that means: Adversaries may interact with the native OS application programming interface (API) to execute behaviors.
-
What they do: direwolf adds malicious registry run keys to ensure persistence across reboots on compromised hosts.
What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: direwolf disables antivirus tools and security software using registry modifications and service interference.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1070.004 File Deletion Stealth
What they do: direwolf deletes Volume Shadow Copies and backup folders via vssadmin and command-line tools to prevent recovery.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1018 Remote System Discovery Discovery
What they do: direwolf performs remote system discovery via Nmap scans to map network topology before deploying ransomware.
What that means: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.
-
T1083 File and Directory Discovery Discovery
What they do: direwolf discovers files and directories using Windows Explorer APIs to identify critical data for encryption.
What that means: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
-
T1021.002 SMB/Windows Admin Shares Lateral Movement
What they do: direwolf moves laterally through SMB shares to access additional systems within the victim network.
What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
-
T1486 Data Encrypted for Impact Impact
What they do: direwolf encrypts victim files using custom symmetric encryption routines targeting business documents and backups.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1490 Inhibit System Recovery Impact
What they do: direwolf halts critical system recovery processes and service restarts to maximize operational disruption.
What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
Ransom Notes (1)
▼The note this group leaves on a compromised machine. Click a filename to read it.
HowToRecoveryFiles.txt
Dear Mr or Ms,
If you are reading this message, it means that:
- your network infrastructure has been compromised
- critical data was leaked
- We decrypted your encrypted files. The anti-leakage system is useless to us. We can provide proof.
- files are encrypted
--------------------------------------------------------------------------
The best and only thing you can do is to contact us
to settle the matter before any losses occurs.
--------------------------------------------------------------------------
We can maintain confidentiality for 3 days for you, during which we will not disclose any information about your intrusion or data leakage.
We can extend the confidentiality period free of charge until we reach an agreement if you contact us within 3 days and communicate effectively with us.
If the confidentiality period expires, we will disclose the relevant information.
We provide complimentary decryption testing services. For specific details, please contact us.
--------------------------------------------------------------------------
We have provided a sample document as proof of our possession of your files and you can download and check it:
- https://gofile.io/d/[snip]
Please be advised that your files are scheduled for public release after 30 working days.
If you want to secure your files, we urge you to reach out to us at your earliest convenience.
--------------------------------------------------------------------------
Contact Details:
- live chat room:
- url:http://direwolf3ddtab5anvhulcelauvoxu2a7l264hqs6vtxtgrqsjfvodid.onion/
- roomID: [snip]
- username: [snip]
- password: [snip]
--------------------------------------------------------------------------
Our official website:
- url:http://direwolfcdkv5whaz2spehizdg22jsuf5aeje4asmetpbt6ri4jnd4qd.onion/
--------------------------------------------------------------------------
How to access .onion website:
1.Download and install TOR Browser https://torproject.org
2.Open it and try to access our onion address
3.Maybe you need to use VPN if it can not open our onion address
Ransom-note text from RansomLook, licensed CC BY 4.0.
Victims (252)
Search, filter and paginate the victim timeline for Direwolf. Showing 201–252 of 252.
| Type | Target | Discovered | Country | Business Category | Intel Link | Leak status |
|---|---|---|---|---|---|---|
| Ransomware | MITACHI id24248 View details | Japan | Other | pending | ||
|
Trade |
||||||
| Ransomware | Kingsford Group id24247 View details | Singapore | Construction / Real Estate | pending | ||
|
[AI generated] Kingsford Group is a company that specializes in property development and investment. It operates globally, with notable activities in the Asia Pacific region. The firm is known for its expertise in identifying lucrative opportunities in the residential, commercial, and hospitality sectors. Its services include project management, marketing and sales, as well as construction management. |
||||||
| Ransomware | Transpedrosa id24246 View details | Brazil | Transportation / Travel / Logistics | pending | ||
|
[AI generated] Transpedrosa is a Brazilian company that specializes in the transportation of liquid and gas products. Established in 1969, they handle an array of materials like chemical, petrochemical, and aviation products. They continue to expand their services beyond their initial local focus, becoming a crucial player in the road transport logistic sector within Brazil. |
||||||
| Ransomware | Clemar Assessoria e Logística em Comércio Internacional id24245 View details | Brazil | Services | leaked | ||
|
[AI generated] Clemar Assessoria e Logística em Comércio Internacional is a Brazilian company specializing in international trade and logistic services. With extensive experience in the sector, it provides assistance in customs clearance, export and import processes, freight forwarding, and international business consultancy. The company aims to facilitate and simplify foreign trade operations for businesses of all sizes. |
||||||
| Ransomware | Meinhardt Malaysia id24244 View details | Malaysia | Manufacturing / Engineering | pending | ||
|
[AI generated] Meinhardt Malaysia is an engineering consultancy firm that offers a diverse range of professional engineering and project management services. The company was established in 1973 and it's a subsidiary of the Meinhardt Group. Their service spans across multiple industries including Building Engineering, Transportation, Water & Environment, and Urban Development. They have numerous landmark projects in their portfolio including the planning and design of technologically advanced buildings. |
||||||
| Ransomware | Electricidad Panamericana id24243 View details | Argentina | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | Coral id23849 View details | United Kingdom | Retail / E-commerce | pending | ||
|
[AI generated] Coral is a renowned UK-based betting and gaming company offering a wide range of services including sports betting, casino games, bingo, poker, and more. The company operates both online and via an extensive network of betting shops. Coral is part of the Entain Group, one of the largest sports betting and gaming groups in the world. |
||||||
| Ransomware | Hyundai Nishat Motor id23848 View details | Pakistan | Communication / Marketing | pending | ||
|
[AI generated] Hyundai Nishat Motor Private Limited is a joint venture between three major international corporations: Nishat Group, Sojitz Corporation, and Hyundai Motors. Established in Pakistan, the company focusses on automobile manufacturing, aiming to meet local demand for Hyundai vehicles. Automation and advanced robotics are incorporated in their high-tech plant for an efficient production process. The company produces various Hyundai models, including SUVs, sedans, and trucks. |
||||||
| Ransomware | YPC MALAYSIA id23847 View details | Malaysia | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | Speed Inter Transport id23025 View details | Thailand | Transportation / Travel / Logistics | pending | ||
|
[AI generated] Speed Inter Transport is a logistics and transportation company that provides high-quality freight transportation services internationally. They specialize in transporting and delivering goods securely and efficiently. The services range from air and sea freight to road services. Their aim is to provide clients with a comprehensive and reliable freight forwarding solution. The company demonstrates a strong commitment to sustainable practices in its operations. |
||||||
| Ransomware | Miguel Veiga, Neiva Santos e Associados. id23024 View details | Portugal | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | Purwana Group id22166 View details | Indonesia | Services | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | Taiwan Flex Electronics id22165 View details | Taiwan, Province of China | IT | pending | ||
|
[AI generated] Taiwan Flex Electronics Corp is a leading technology company based in Taiwan that specializes in producing and selling electronics. They focus on developing flexible electronic technology products, including flexible printed circuits. Their key areas of expertise bring the intersection of material science and electronics together, central to innovations in electronics like digital devices. They serve a broad range of industries such as automotive, computing, and consumer electronics. |
||||||
| Ransomware | Aroeira Salles Advogados id21929 View details | Brazil | Finance / Legal / Insurance | pending | ||
|
[AI generated] Aroeira Salles Advogados is a Brazilian law firm providing a comprehensive array of legal services. Their expertise covers a range of disciplines such as labor law, public law, civil law, business law, and environmental law. Established in 2001, the firm serves both individuals and corporations and is known for its commitment to ethical and effective legal practice. Aroeira Salles prides itself on its use of technology for driving efficiency in legal services. |
||||||
| Ransomware | Bolt Nut Manufacturing id21928 View details | United Kingdom | Manufacturing / Engineering | pending | ||
|
[AI generated] Bolt Nut Manufacturing is a dedicated company involved in manufacturing and delivering superior quality bolt nuts for various industries. The company specializes in creating high-strength, durable bolt nuts using best-in-class materials. They serve clientele from diverse industries, providing reliable solutions that meet specific needs. Their commitment to quality, prompt delivery, and customer service sets them apart. |
||||||
| Ransomware | Dynacast id21927 View details | United States | Manufacturing / Engineering | pending | ||
|
[AI generated] Dynacast is a global manufacturing company specializing in engineered metal components. It provides solutions using precision die casting, metal injection molding, and CNC machining. It caters to various sectors including automotive, healthcare, and consumer electronics. Established in 1936, Dynacast operates more than 20 manufacturing facilities in over a dozen countries. |
||||||
| Ransomware | 台灣東洋國際儀表股份有限公司 id21926 View details | Taiwan, Province of China | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | Wine Works Australia id21925 View details | Australia | Communication / Marketing | pending | ||
|
[AI generated] Wine Works Australia is a wine sales and marketing company that represents local and international wineries in export markets. They focus on establishing sustainable and profitable relationships with business partners. The company uses its extensive knowledge of wine and international markets to develop effective strategies to drive wine sales in different regions. They offer services to wineries seeking to start or expand their export operations. |
||||||
| Ransomware | International Freight & Commerce id21809 View details | Tunisia | Retail / E-commerce | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | Avv Emilio Marco Casali id21735 View details | Italy | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | Immigration Advice Service id21734 View details | United Kingdom | Services | pending | ||
|
[AI generated] The Immigration Advice Service (IAS) is a UK-based legal firm specializing in immigration issues. It assists with various immigration matters such as visa applications, citizenship, asylum, business immigration, and more. It has a team of expert immigration lawyers who offer advice and services to individuals, families, and businesses. IAS also provides services globally with several offices in different countries. |
||||||
| Ransomware | ksubsea-group id21733 View details | Norway | Services | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | HCK Capital Group id21537 View details | Malaysia | Communication / Marketing | pending | ||
|
[AI generated] HCK Capital Group is a Malaysian investment holding company, primarily operating in the fields of property development, education, and media. Founded by Tan Sri Clement Hii, the group invests in potential high-growth sectors, particularly in consumer-driven businesses, seeking unique market opportunities to maximize capital growth. |
||||||
| Ransomware | Kingsford Development & LEADBUILD Construction Pte Ltd id21536 View details | Singapore | Construction / Real Estate | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | MGI Singapore PAC id21404 View details | Singapore | Services | pending | ||
|
[AI generated] MGI Singapore PAC is a Singapore-based accounting firm providing comprehensive services to clients worldwide. Part of the MGI Worldwide CPAAI, a global accounting network, MGI Singapore PAC offers financial, tax, corporate and business advisory solutions. They cater to various industries including construction, educators/ training providers, engineering, real estate, hospitality, etc. |
||||||
| Ransomware | W.L. FOODS id21403 View details | Philippines | Agriculture / Food | pending | ||
|
[AI generated] W.L. Foods is a prominent food manufacturing and distribution company in the Philippines. It was founded in 1986 and quickly gained fame for its production of high-quality food products, especially in the snack food category. They offer a range of products like biscuits, wafers, candies, chocolates, pretzels, and drinks. W.L. Foods also exports its products to several countries across North America, Europe, Middle East, and Asia. |
||||||
| Ransomware | Acarlar Ltd id21402 View details | Türkiye | Services | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | Universidad Mayor id21251 View details | Chile | Education | pending | ||
|
Universidad Mayor (UM), acreditación institucional con la Middle States Commission on Higher Education de los EE.UU (MSCHE). |
||||||
| Ransomware | Anadolu Hastaneleri id21250 View details | Türkiye | Healthcare / Pharma | pending | ||
|
Anadolu Hospitals strives to become the preferred brand in the region with its experienced healthcare staff. |
||||||
| Ransomware | Pergamon Status Diş Ticaret A Ş id21249 View details | Türkiye | Other | pending | ||
|
Pergamon Status Diş Ticaret A Ş is a company that operates in the international trade industry. |
||||||
| Ransomware | Akribis Systems id21248 View details | Singapore | Services | pending | ||
|
Akribis Systems is a global designer and manufacturer of direct drive motors, stages, positioning systems. |
||||||
| Ransomware | Doak Shirreff Lawyers id21066 View details | Canada | Finance / Legal / Insurance | pending | ||
|
Doak Shirreff Kelowna Lawyers is a full-service law firm situated in Kelowna, British Columbia. |
||||||
| Ransomware | UPG Enterprises id21065 View details | United States | Communication / Marketing | pending | ||
|
UPG Enterprises is a privately held operator of industrial companies that focus on steel, lamination, rail products and metal-wares. |
||||||
| Ransomware | MITACHI (HK) COMPANY LIMITED id21064 View details | Hong Kong | Services | pending | ||
|
Mitachi (Hk) Company Limited is headquartered in Hong Kong. Subsidiary of Japan's MITACHI CO., LTD. |
||||||
| Ransomware | INICIA id21063 View details | Dominican Republic | Communication / Marketing | pending | ||
|
Inicia Ltd specializes in providing a range of poultry-related products and services. |
||||||
| Ransomware | Faria Braga Advogados Associados id21062 View details | Brazil | Finance / Legal / Insurance | pending | ||
|
Faria Braga Advogados Associados is a society of environmental and urban law, working with public bodies company based out of R Paraiba, 1323, 4° Andar, Savassi, Belo Horizonte, MG Brazil. |
||||||
| Ransomware | THAIRUNG GROUP id20722 View details | Thailand | Telecommunications | pending | ||
|
Thairung Group is a leading group of companies in the automobile business. |
||||||
| Ransomware | GB Group id20721 View details | United Kingdom | Communication / Marketing | pending | ||
|
GBGroup is in the process of developing innovative solutions for their clients. |
||||||
| Ransomware | K.M. Packaging Co., Ltd id20557 View details | Thailand | Manufacturing / Engineering | pending | ||
|
K.M. Packaging Public Company Limited is a company specializing in the production of food and beverage packaging. |
||||||
| Ransomware | Medifarma id20556 View details | Peru | Agriculture / Food | pending | ||
|
The leading pharmaceutical laboratory in Peru, present in eight countries and with more than 3,600 employees. |
||||||
| Ransomware | Health-Insights id20555 View details | Malaysia | Healthcare / Pharma | pending | ||
|
A worldwide leading, reliable, highest performance and most cost effective HCIT (HealthCare Information Technology) services provider. |
||||||
| Ransomware | YIEH UNITED STEEL CORP id20445 View details | Taiwan, Province of China | Manufacturing / Engineering | pending | ||
|
Yieh United Steel Corp is a company that operates in the Minerals & Mining industry |
||||||
| Ransomware | IoTechWorld id20444 View details | India | IT | pending | ||
|
IoTechWorld Avigation, India's largest drone manufacturer, aims to transform agriculture with advanced drones. |
||||||
| Ransomware | EPC Group id20443 View details | United States | Manufacturing / Engineering | pending | ||
|
The EPC Group is an internationally active engineering and plant construction company as well as a provider of innovative technologies. |
||||||
| Ransomware | Bin Faqeeh Real Estate id20363 View details | Bahrain | Construction / Real Estate | pending | ||
|
Kingdom of Bahrain’s leading real estate investment company. |
||||||
| Ransomware | TDM Technical Services id20362 View details | Canada | IT | pending | ||
|
TDM Technical Services provides the best human resources available, on an as needed contract basis. |
||||||
| Ransomware | DataPost id20270 View details | Singapore | Communication / Marketing | pending | ||
|
DataPost Pte Ltd is a leading provider of secured data handling solutions based in Singapore, specializing in e-invoicing and data privacy services. |
||||||
| Ransomware | kiwi86 id20269 View details | Taiwan, Province of China | Communication / Marketing | pending | ||
|
Provide 'fair' and 'professional': [Insurance Product Database] and related [Policy: Physical Examination and Management] system services |
||||||
| Ransomware | qualitas-pro id20268 View details | Italy | Communication / Marketing | pending | ||
|
Qualitas Commercialisti Associati is an association of Chartered Accountants able to offer consultancy and assistance in corporate, fiscal, contractual, pre-bankruptcy and bankruptcy matters. |
||||||
| Ransomware | SMV Thailand id20267 View details | Thailand | Manufacturing / Engineering | pending | ||
|
Wilson International is a global commodities trading company specializing in the supply chain for fertilizer and petrochemical manufacturing facilities. |
||||||
| Ransomware | Wilson International id20266 View details | India | Manufacturing / Engineering | pending | ||
|
Wilson International is a global commodities trading company specializing in the supply chain for fertilizer and petrochemical manufacturing facilities. |
||||||
| Ransomware | Legal Practice Board of Western Australia id20265 View details | Australia | Finance / Legal / Insurance | pending | ||
|
[AI generated] The Legal Practice Board of Western Australia is an independent statutory body established under the Legal Profession Act of 2008. Its mission is to control the admission, registration, and discipline of lawyers in Western Australia. It approves the rules of conduct for legal practitioners and institutes legal disciplinary action when necessary. The board also oversees areas like continuing professional development and the managed trust accounts of law firms. |
||||||