direwolf
First seen May 22, 2025Active125 claimed victims
The claims below are reproduced as posted by direwolf on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Dire Wolf is a sophisticated human-operated ransomware group first documented in May 2025, written in Golang using Curve25519/ChaCha20 encryption, targeting manufacturing and technology sectors across 13+ countries with ransoms up to $500,000, operated by a tight core team rather than a broad affiliate program.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Akribis Systems | July 20, 2025 | ransomware_live | — |
| Pergamon Status Diş Ticaret A Ş | July 20, 2025 | ransomware_live | — |
| Anadolu Hastaneleri | July 20, 2025 | ransomware_live | — |
| Universidad Mayor | July 20, 2025 | ransomware_live | — |
| Faria Braga Advogados Associados | July 8, 2025 | ransomware_live | — |
| INICIA | July 8, 2025 | ransomware_live | — |
| MITACHI (HK) COMPANY LIMITED | July 8, 2025 | ransomware_live | — |
| UPG Enterprises | July 8, 2025 | ransomware_live | — |
| Doak Shirreff Lawyers | July 8, 2025 | ransomware_live | — |
| GB Group | June 18, 2025 | ransomware_live | — |
| Health-Insights | June 10, 2025 | ransomware_live | — |
| Medifarma | June 10, 2025 | ransomware_live | — |
| K.M. Packaging Co., Ltd | June 10, 2025 | ransomware_live | — |
| EPC Group | June 4, 2025 | ransomware_live | — |
| YIEH UNITED STEEL CORP | June 2, 2025 | ransomware_live | — |
| TDM Technical Services | May 30, 2025 | ransomware_live | — |
| Legal Practice Board of Western Australia | May 26, 2025 | ransomware_live | — |
| DataPost | May 26, 2025 | ransomware_live | — |
| THAIRUNG GROUP | May 26, 2025 | ransomware_live | — |
| qualitas-pro | May 23, 2025 | ransomware_live | — |
| kiwi86 | May 23, 2025 | ransomware_live | — |
| IoTechWorld | May 14, 2025 | ransomware_live | — |
| Wilson International | May 9, 2025 | ransomware_live | — |
| Bin Faqeeh Real Estate | April 25, 2025 | ransomware_live | — |
| SMV Thailand | April 17, 2025 | ransomware_live | — |
← NewerPage 2 of 2
Claim data from ransomware.live and RansomLook (CC BY 4.0).