Ransomware group
Direwolf ransomware: victims and leak site activity
The Direwolf ransomware group has listed 134 victims on its leak site since May 2025; its latest post is from 9 September 2026. Most affected countries: United States, Malaysia and Thailand. Most targeted sector: Healthcare.
Total posts
134
First seen
2025-05-27
Latest post
2026-09-09
Countries hit
37
About Direwolf
Dire Wolf is a sophisticated human-operated ransomware group first documented in May 2025, written in Golang using Curve25519/ChaCha20 encryption, targeting manufacturing and technology sectors across 13+ countries with ransoms up to $500,000, operated by a tight core team rather than a broad affiliate program.
Most targeted countries
- United States 32
- Malaysia 10
- Thailand 9
- Brazil 8
- United Kingdom 7
- Singapore 5
- Turkey 5
- Taiwan 5
- Sweden 4
- Australia 3
Most targeted sectors
- Healthcare 21
- Professional Services 20
- Technology 20
- Manufacturing 19
- Financial Services 11
- Transportation 8
- Agriculture and Food Production 6
- Education 5
- Energy & Utilities 5
- Retail & E-Commerce 5