Signalis
sign in--:--:--UTC
Threat actors

Direwolf

☆ pin
Also known as Dire Wolf, DireWolf
Reports
17
First seen
Mar 19, 2026
Last seen
Aug 11, 2026
Motivation
Financial

Targeting

Sectors
Healthcare ×4Technology ×2Professional Services ×1Retail & E-commerce ×1
Victim regions
×1
×1
Germany×1
United States×1
Spain×1

Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.

Top ATT&CK techniques

T1027.002 Obfuscated Files or Information: Software Packing ×1T1566 Phishing ×1T1562 Impair Defenses ×1T1110 Brute Force ×1T1569.002 System Services: Service Execution ×1T1562.009 Impair Defenses: Safe Mode Boot ×1T1486 Data Encrypted for Impact ×1T1543.003 Create or Modify System Process: Windows Service ×1T1059.003 Command and Scripting Interpreter: Windows Command Shell ×1T1489 Service Stop ×1T1547 Boot or Logon Autostart Execution ×1T1078 Valid Accounts ×1

Indicators

filename ×49domain ×15

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2024-40766 (exploited)CVE-2024-47575 (exploited)CVE-2024-50383 (exploited)

Recent reports

High

Direwolf ransomware gang publishes Leafwell as victim

ransomware.liveMedium

Direwolf ransomware gang publishes BigSpark as victim

ransomware.liveHigh

Direwolf ransomware gang claims Chat Jurídico victim

ransomware.liveHigh

Direwolf ransomware gang claims new victim: Merge

ransomware.liveMedium

Direwolf ransomware gang publishes Swyft Inc. as victim

ransomware.liveHigh

Direwolf ransomware claims AliveCor, Inc. as victim

ransomware.liveHigh

Direwolf ransomware gang publishes Statista GmbH as victim

ransomware.liveHigh

Direwolf publishes Quironsalud as victim

ransomware.liveHigh

Direwolf ransomware gang publishes Health Carousel as victim

ransomware.liveMedium

Direwolf ransomware gang publishes new victim: Fondo

ransomware.liveHigh

Direwolf ransomware group claims Osmo Wallet victim

ransomware.liveHigh

Direwolf ransomware gang claims Jewelex as victim

ransomware.liveHigh

Direwolf ransomware claims Clínica Vida as victim

ransomware.liveHigh

Direwolf ransomware gang publishes Did Asia as victim

ransomware.liveHigh

Direwolf ransomware group claims Nueva Pescanova Group as victim

ransomware.liveHigh

State of ransomware in 2026: post-quantum cryptography, encryptionless extortion, and industrialized access brokers

Kaspersky SecurelistHigh

EDR Killers Explained: Beyond the Drivers — ESET's Analysis of 90 Active Tools

ESET WeLiveSecurity

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.

Sign upSee plans