direwolf
First seen May 22, 2025Active139 claimed victims
The claims below are reproduced as posted by direwolf on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Dire Wolf is a sophisticated human-operated ransomware group first documented in May 2025, written in Golang using Curve25519/ChaCha20 encryption, targeting manufacturing and technology sectors across 13+ countries with ransoms up to $500,000, operated by a tight core team rather than a broad affiliate program.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Wine Works Australia | August 25, 2025 | ransomware_live | — |
| 台灣東洋國際儀表股份有限公司 | August 25, 2025 | ransomware_live | — |
| Dynacast | August 25, 2025 | ransomware_live | — |
| Bolt Nut Manufacturing | August 25, 2025 | ransomware_live | — |
| Aroeira Salles Advogados | August 25, 2025 | ransomware_live | — |
| International Freight & Commerce | August 17, 2025 | ransomware_live | — |
| ksubsea-group | August 14, 2025 | ransomware_live | — |
| Immigration Advice Service | August 14, 2025 | ransomware_live | — |
| Avv Emilio Marco Casali | August 14, 2025 | ransomware_live | — |
| Kingsford Development & LEADBUILD Construction Pte Ltd | August 5, 2025 | ransomware_live | — |
| HCK Capital Group | August 5, 2025 | ransomware_live | — |
| Acarlar Ltd | July 28, 2025 | ransomware_live | — |
| W.L. FOODS | July 28, 2025 | ransomware_live | — |
| MGI Singapore PAC | July 28, 2025 | ransomware_live | — |
| Akribis Systems | July 20, 2025 | ransomware_live | — |
| Pergamon Status Diş Ticaret A Ş | July 20, 2025 | ransomware_live | — |
| Anadolu Hastaneleri | July 20, 2025 | ransomware_live | — |
| Universidad Mayor | July 20, 2025 | ransomware_live | — |
| Faria Braga Advogados Associados | July 8, 2025 | ransomware_live | — |
| INICIA | July 8, 2025 | ransomware_live | — |
| MITACHI (HK) COMPANY LIMITED | July 8, 2025 | ransomware_live | — |
| UPG Enterprises | July 8, 2025 | ransomware_live | — |
| Doak Shirreff Lawyers | July 8, 2025 | ransomware_live | — |
| GB Group | June 18, 2025 | ransomware_live | — |
| Health-Insights | June 10, 2025 | ransomware_live | — |
| Medifarma | June 10, 2025 | ransomware_live | — |
| K.M. Packaging Co., Ltd | June 10, 2025 | ransomware_live | — |
| EPC Group | June 4, 2025 | ransomware_live | — |
| YIEH UNITED STEEL CORP | June 2, 2025 | ransomware_live | — |
| TDM Technical Services | May 30, 2025 | ransomware_live | — |
| Legal Practice Board of Western Australia | May 26, 2025 | ransomware_live | — |
| DataPost | May 26, 2025 | ransomware_live | — |
| THAIRUNG GROUP | May 26, 2025 | ransomware_live | — |
| qualitas-pro | May 23, 2025 | ransomware_live | — |
| kiwi86 | May 23, 2025 | ransomware_live | — |
| IoTechWorld | May 14, 2025 | ransomware_live | — |
| Wilson International | May 9, 2025 | ransomware_live | — |
| Bin Faqeeh Real Estate | April 25, 2025 | ransomware_live | — |
| SMV Thailand | April 17, 2025 | ransomware_live | — |
← NewerPage 2 of 2
Claim data from ransomware.live and RansomLook (CC BY 4.0).