Direwolf

☆ pin

Also known as DireWolf, Dire Wolf

Reports

First seen

Mar 19, 2026

Last seen

Oct 13, 2026

Motivation

Financial

Targeting

Sectors

Healthcare ×12 Technology ×6 Transport & Logistics ×4 Education ×3 Media & Entertainment ×2 Professional Services ×2 Financial Services ×2 Retail & E-commerce ×1

Victim regions

×1

×8

United States×8

United Kingdom×2

Brazil×1

Germany×1

Spain×1

Italy×1

Chile×1

Türkiye×1

Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.

Top ATT&CK techniques

T1566 Phishing ×1T1569.002 System Services: Service Execution ×1T1562.009 Impair Defenses: Safe Mode Boot ×1T1059.003 Command and Scripting Interpreter: Windows Command Shell ×1T1068 Exploitation for Privilege Escalation ×1T1562 Impair Defenses ×1T1486 Data Encrypted for Impact ×1T1547 Boot or Logon Autostart Execution ×1T1078 Valid Accounts ×1T1021 Remote Services ×1T1133 External Remote Services ×1T1562.001 Impair Defenses: Disable or Modify Tools ×1

Indicators

domain ×81filename ×49hash_sha256 ×9hash_md5 ×6ip_v4 ×4hash_sha1 ×2hash_sha512 ×1

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2024-40766 (exploited)CVE-2024-47575 (exploited)CVE-2024-50383 (exploited)

Recent reports

High

Direwolf

Targeting

Top ATT&CK techniques

Indicators

Associated CVEs

Recent reports

Direwolf ransomware gang publishes Interseguro as victim

Direwolf ransomware publishes Softruck as victim

Direwolf ransomware gang claims Port of Tanjung Pelepas breach

Direwolf publishes RelyComply AML Platform as ransomware victim

Direwolf ransomware claims Sales Boomerang victim

Direwolf ransomware group publishes new victim: EMS1R

Direwolf ransomware gang publishes Precision Vehicle Logistics as victim

Direwolf ransomware gang publishes TrainMe as victim

Direwolf ransomware gang publishes Lightcast as victim

Direwolf publishes Semper Laser as ransomware victim

Direwolf ransomware gang publishes eAssist Dental Solutions as victim

Direwolf ransomware gang claims new victim: myLaurel

Direwolf ransomware gang publishes Mission Pet Health as victim

Direwolf claims Wolfram Research ransomware breach

Direwolf publishes Cartrack Holdings as ransomware victim

Direwolf ransomware gang publishes PTT Oil and Retail Business as victim

Direwolf ransomware gang claims Oportunidados victim

Direwolf ransomware gang publishes Honeycomb Programs Inc as victim

Direwolf ransomware gang publishes PT Intraco Penta Tbk as victim

Direwolf ransomware gang claims THQ Nordic breach

Direwolf ransomware gang publishes Erdem Hospital as victim

Direwolf ransomware gang publishes Hospital Clínico Universidad de Chile

Direwolf ransomware gang claims National Kidney Registry breach

Direwolf ransomware gang publishes Studio Legale ESE as victim

Direwolf ransomware gang publishes NorthStar as victim

Direwolf ransomware gang publishes Aztec Software as victim

Direwolf ransomware gang publishes The Revel Collective as victim

Direwolf ransomware gang publishes ProSim Aviation Research as victim

Direwolf ransomware gang publishes Authenticate Information Systems as victim

Direwolf ransomware gang publishes Diaco Global as victim