werewolves
First seen December 20, 2023Active26 claimed victims
The claims below are reproduced as posted by werewolves on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
WereWolves is a Russian-speaking ransomware group that emerged in May 2023, using a modified LockBit 3 (Black) encryptor, operating an unusual public website that actively recruits new members and offers a bug-bounty program with rewards up to $1 million, with at least 26 victims across Russia, the US, and Europe.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| vsexshop.ru | March 4, 2024 | ransomware_live | — |
| davidsbridal.com | February 14, 2024 | ransomware_live | — |
| solveindustrial.com | December 22, 2023 | ransomware_live | — |
| vasexperts.ru | December 17, 2023 | ransomware_live | — |
| forabank.ru | December 15, 2023 | ransomware_live | — |
| auditexpertnn.ru | November 2, 2023 | ransomware_live | — |
| promproektspb.ru | November 2, 2023 | ransomware_live | — |
| kailos.ru | October 14, 2023 | ransomware_live | — |
| gaztranscom.ru | October 14, 2023 | ransomware_live | — |
| atol.ru | October 4, 2023 | ransomware_live | — |
| roomhotel-sochi.ru | September 30, 2023 | ransomware_live | — |
| carmoney.ru | September 29, 2023 | ransomware_live | — |
| croc.ru | September 27, 2023 | ransomware_live | — |
| maritimebank.com | September 27, 2023 | ransomware_live | — |
| habarovsk.amaks | September 24, 2023 | ransomware_live | — |
| avrora24.ru | September 22, 2023 | ransomware_live | — |
| krasnoyarsk.amaks | September 14, 2023 | ransomware_live | — |
| acac.com | September 13, 2023 | ransomware_live | — |
| lapostemobile.fr | August 28, 2023 | ransomware_live | — |
| emprint.com | August 4, 2023 | ransomware_live | — |
| qb2b.ru | July 1, 2023 | ransomware_live | — |
| lzaim38.ru | June 17, 2023 | ransomware_live | — |
| interfides.de | May 25, 2023 | ransomware_live | — |
| metalnet.nl | May 24, 2023 | ransomware_live | — |
| aek.mk | May 23, 2023 | ransomware_live | — |
| bigcenters.rs | May 18, 2023 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).