Dire Wolf — Ransomware Profile
Dire Wolf is a sophisticated human-operated ransomware group first documented in May 2025, written in Golang using Curve25519/ChaCha20 encryption, targeting manufacturing and technology sectors across 13+ countries with ransoms up to $500,000, operated by a tight core team rather than a broad affiliate program.Also tracked as
Direwolf
IntelFusions coverage (7)
- Malaysia's water asset firm lands on Qilin's leak site 2026-10-19 · Cyber Incidents
- Extortion crews turn on ports and fuel terminals 2026-09-21 · Ransomware
- More ransomware crews, but far fewer victims each 2026-09-13 · Ransomware
- A court and a hospital land on South America's leak sites 2026-09-06 · Cyber Incidents
- Leak sites turn on Southeast Asia's listed companies 2026-09-03 · Cyber Incidents
- New crew Storm goes after US clinics, banks and factories 2026-08-25 · Ransomware
- Mexico is suddenly all over the ransomware leak sites 2026-08-22 · Cyber Incidents
Tools & malware
- Dire Wolf Ransomware Ransomware
- Tox Communication Tool
- UPX Packer
Recent claimed victims
- Interseguro 2026-10-13
- Softruck 2026-10-04
- Port of Tanjung Pelepas 2026-09-11
- RelyComply AML Platform 2026-09-09
- EMS1R 2026-09-08
- Sales Boomerang 2026-09-08
- Lightcast 2026-09-07
- Semper Laser 2026-09-07
- Precision Vehicle Logistics 2026-09-07
- TrainMe 2026-09-07
- myLaurel 2026-09-06
- eAssist Dental Solutions 2026-09-06
- Mission Pet Health 2026-09-05
- Wolfram Research 2026-09-04
- PTT Oil and Retail Business 2026-09-02
- Cartrack Holdings 2026-09-02
- Honeycomb Programs Inc 2026-09-01
- Oportunidados 2026-09-01
- PT Intraco Penta Tbk 2026-09-01
- Erdem Hospital 2026-08-30
- Hospital Clnico Universidad de Chile 2026-08-30
- THQ Nordic 2026-08-30
- Studio Legale ESE 2026-08-25
- National Kidney Registry 2026-08-25
- Diaco Global 2026-08-21
Vendor research
- Dire Wolf Ransomware (Protection Bulletin) Symantec
- Dire Wolf Strikes: New Ransomware Group Targeting Global Sectors LevelBlue SpiderLabs
- Dire Wolf Ransomware: Threat Combining Data Encryption and Leak Extortion AhnLab ASEC
- Ongoing Dire Wolf Ransomware Campaign (AL-2025-082) Cyber Security Agency of Singapore