Ransomware group
Direwolf ransomware: victims and leak site activity
The Direwolf ransomware group has listed 137 victims on its leak site since May 2025; its latest post is from 13 October 2026. Most affected countries: United States, Malaysia and Brazil. Most targeted sector: Healthcare.
Total posts
137
First seen
2025-05-27
Latest post
2026-10-13
Countries hit
37
About Direwolf
Dire Wolf is a sophisticated human-operated ransomware group first documented in May 2025, written in Golang using Curve25519/ChaCha20 encryption, targeting manufacturing and technology sectors across 13+ countries with ransoms up to $500,000, operated by a tight core team rather than a broad affiliate program.
- Leak site (Tor)
- http://direwolfcdkv5whaz2spehizdg22jsuf5aeje4asmetpbt6ri4jnd4qd.onion
- Profile
- ransomware.live
Most targeted countries
- United States 32
- Malaysia 11
- Brazil 9
- Thailand 9
- United Kingdom 7
- Singapore 5
- Turkey 5
- Taiwan 5
- Sweden 4
- Australia 3
Most targeted sectors
- Healthcare 21
- Technology 21
- Professional Services 20
- Manufacturing 19
- Financial Services 12
- Transportation 9
- Agriculture and Food Production 6
- Education 5
- Energy & Utilities 5
- Retail & E-Commerce 5