direwolf
First seen May 22, 2025Active125 claimed victims
The claims below are reproduced as posted by direwolf on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Dire Wolf is a sophisticated human-operated ransomware group first documented in May 2025, written in Golang using Curve25519/ChaCha20 encryption, targeting manufacturing and technology sectors across 13+ countries with ransoms up to $500,000, operated by a tight core team rather than a broad affiliate program.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Mission Pet Health | September 5, 2026 | ransomware_live | — |
| Wolfram Research | September 4, 2026 | ransomlook | — |
| Cartrack Holdings | September 2, 2026 | ransomlook | — |
| PTT Oil and Retail Business | September 2, 2026 | ransomlook | — |
| Oportunidados | September 1, 2026 | ransomlook | — |
| PT Intraco Penta Tbk | September 1, 2026 | ransomlook | — |
| Honeycomb Programs Inc | September 1, 2026 | ransomlook | — |
| Hospital Clnico Universidad de Chile | August 30, 2026 | ransomlook | — |
| Erdem Hospital | August 30, 2026 | ransomlook | — |
| THQ Nordic | August 30, 2026 | ransomlook | — |
| Studio Legale ESE | August 25, 2026 | ransomlook | — |
| National Kidney Registry | August 25, 2026 | ransomlook | — |
| Studee | August 21, 2026 | ransomware_live | — |
| Reviso Cloud Accounting Limited | August 21, 2026 | ransomware_live | — |
| MCT Group of Companies | August 21, 2026 | ransomware_live | — |
| HP Carriers | August 21, 2026 | ransomware_live | — |
| Allstar Industries | August 21, 2026 | ransomware_live | — |
| Deer Creek-Mackinaw CUSD | August 21, 2026 | ransomware_live | — |
| iSON XPERIENCES | August 21, 2026 | ransomware_live | — |
| Diaco Global | August 21, 2026 | ransomware_live | — |
| Authenticate Information Systems | August 21, 2026 | ransomware_live | — |
| ProSim Aviation Research | August 21, 2026 | ransomware_live | — |
| The Revel Collective | August 21, 2026 | ransomware_live | — |
| Aztec Software | August 21, 2026 | ransomware_live | — |
| NorthStar | August 21, 2026 | ransomware_live | — |
| Lifesum | August 19, 2026 | ransomware_live | — |
| PayUp | August 19, 2026 | ransomware_live | — |
| InfoFlo CRM | August 19, 2026 | ransomware_live | — |
| Photon Health, Inc. | August 19, 2026 | ransomware_live | — |
| Eva AI Limited | August 17, 2026 | ransomware_live | — |
| Mighty Kingdom | August 17, 2026 | ransomware_live | — |
| Wishfully Studios | August 17, 2026 | ransomware_live | — |
| Arizona State University (ASU) | August 17, 2026 | ransomware_live | — |
| DXS International | August 15, 2026 | ransomware_live | — |
| PayrHealth | August 15, 2026 | ransomware_live | — |
| Colla Health | August 15, 2026 | ransomware_live | — |
| TOTVS | August 15, 2026 | ransomware_live | — |
| AAM:HOA Management | August 15, 2026 | ransomware_live | — |
| DodoPayments | August 15, 2026 | ransomware_live | — |
| Leafwell | August 11, 2026 | ransomware_live | — |
| Osmo Wallet | August 10, 2026 | ransomware_live | — |
| Fondo | August 10, 2026 | ransomware_live | — |
| Health Carousel | August 10, 2026 | ransomware_live | — |
| Quironsalud | August 10, 2026 | ransomware_live | — |
| Statista GmbH | August 10, 2026 | ransomware_live | — |
| AliveCor, Inc. | August 10, 2026 | ransomware_live | — |
| Swyft Inc. | August 10, 2026 | ransomware_live | — |
| Merge | August 10, 2026 | ransomware_live | — |
| Chat Jurídico | August 10, 2026 | ransomware_live | — |
| BigSpark | August 10, 2026 | ransomware_live | — |
| Nueva Pescanova Group | June 12, 2026 | ransomware_live | — |
| Did Asia | June 12, 2026 | ransomware_live | — |
| Clínica Vida | June 12, 2026 | ransomware_live | — |
| Jewelex | June 12, 2026 | ransomware_live | — |
| Chemsain Konsultant Sdn Bhd | January 13, 2026 | ransomware_live | — |
| Perdana Petroleum Berhad | January 13, 2026 | ransomware_live | — |
| Tepco-Group | January 13, 2026 | ransomware_live | — |
| Mohammad Omar Bin Haider Holding Group | January 9, 2026 | ransomware_live | — |
| Bauerfeind | January 9, 2026 | ransomware_live | — |
| Varimed Medikal | January 4, 2026 | ransomware_live | — |
| Sunzen Biotech Berhad | January 4, 2026 | ransomware_live | — |
| Laurenzano Logistics | January 4, 2026 | ransomware_live | — |
| KwikLedgers | January 4, 2026 | ransomware_live | — |
| PernelMedia | January 4, 2026 | ransomware_live | — |
| Bina Darulaman Berhad | January 4, 2026 | ransomware_live | — |
| Hydrodiseño | January 4, 2026 | ransomware_live | — |
| Adnan Sundra & Low | December 22, 2025 | ransomware_live | — |
| Sanyang Motor | December 22, 2025 | ransomware_live | — |
| Guan Chong Berhad | December 22, 2025 | ransomware_live | — |
| Office of Public Sector Anti-Corruption Commission | December 22, 2025 | ransomware_live | — |
| Ranger Investigation Guard | December 22, 2025 | ransomware_live | — |
| Polaris Parks | December 22, 2025 | ransomware_live | — |
| Electricidad Panamericana | November 21, 2025 | ransomware_live | — |
| Clemar Assessoria e Logística em Comércio Internacional | November 21, 2025 | ransomware_live | — |
| Transpedrosa | November 21, 2025 | ransomware_live | — |
| Kingsford Group | November 20, 2025 | ransomware_live | — |
| MITACHI | November 20, 2025 | ransomware_live | — |
| K.M. Packaging | November 20, 2025 | ransomware_live | — |
| YPC MALAYSIA | November 13, 2025 | ransomware_live | — |
| Hyundai Nishat Motor | November 13, 2025 | ransomware_live | — |
| Coral | November 13, 2025 | ransomware_live | — |
| Meinhardt Malaysia | October 24, 2025 | ransomware_live | — |
| Miguel Veiga, Neiva Santos e Associados. | October 5, 2025 | ransomware_live | — |
| Speed Inter Transport | October 5, 2025 | ransomware_live | — |
| Taiwan Flex Electronics | September 6, 2025 | ransomware_live | — |
| Purwana Group | September 6, 2025 | ransomware_live | — |
| Wine Works Australia | August 25, 2025 | ransomware_live | — |
| 台灣東洋國際儀表股份有限公司 | August 25, 2025 | ransomware_live | — |
| Dynacast | August 25, 2025 | ransomware_live | — |
| Bolt Nut Manufacturing | August 25, 2025 | ransomware_live | — |
| Aroeira Salles Advogados | August 25, 2025 | ransomware_live | — |
| International Freight & Commerce | August 17, 2025 | ransomware_live | — |
| ksubsea-group | August 14, 2025 | ransomware_live | — |
| Immigration Advice Service | August 14, 2025 | ransomware_live | — |
| Avv Emilio Marco Casali | August 14, 2025 | ransomware_live | — |
| Kingsford Development & LEADBUILD Construction Pte Ltd | August 5, 2025 | ransomware_live | — |
| HCK Capital Group | August 5, 2025 | ransomware_live | — |
| Acarlar Ltd | July 28, 2025 | ransomware_live | — |
| W.L. FOODS | July 28, 2025 | ransomware_live | — |
| MGI Singapore PAC | July 28, 2025 | ransomware_live | — |
Page 1 of 2Older →
Claim data from ransomware.live and RansomLook (CC BY 4.0).