RansomwareSOCRadar source-of-truth import; pending cross-source consensus confidence

Direwolf

Dire Wolf is a financially motivated ransomware group that first emerged in May 2025, rapidly gaining notoriety for its disruptive double extortion attacks. The group is human-operated and distinguishes itself by using customized encryptors tailored to specific victims and establishing personalized negotiation channels. While their leak site claims a New York, NY base, analysts generally consider this a deliberate misdirection. The group explicitly states its motivation as purely financial, with no political or moral agenda.

Directory Briefing

Top 10 Talking Points

Direwolf is tracked as a ransomware and extortion operation.¹

Treat the named ransomware as the visible impact component of a broader intrusion, not as proof of who performed every earlier action.

Initial access should be scoped across identity and Internet-facing systems.^1,2

The retained behavior points to credentials, remote access, phishing, or exposed services; preserve authentication, VPN, edge-device, email, and remote-administration evidence together.

The first detected host should not define the compromise boundary.¹

Check for earlier credential use, remote sessions, administrative changes, and data access because public actor records often understate the full pre-impact timeline.

Identity compromise is a central scoping issue.¹

Evidence includes credential or account abuse; response should cover privileged, service, remote-access, SaaS, and recovery identities—not just interactive user passwords.

The likely objective is control of high-value systems, including virtual infrastructure.¹

Lateral movement, administrative access, and hypervisor concentration can turn a limited foothold into broad business interruption.

Legitimate administration tools may carry much of the attack.¹

Reported tooling or behavior includes PowerShell, remote execution, or other dual-use administration behavior; detection must distinguish authorized administration from anomalous context and sequence.

Security and recovery controls are part of the target set.¹

Defense impairment or evidence removal is retained in the source record. Protect immutable backups and investigate access to recovery systems before trusting them.

This is a data-breach problem as well as a recovery problem.¹

Collection or exfiltration behavior includes data staging and exfiltration; counsel and forensics need a shared record of what was accessed, staged, and transferred.

Victimology is broad enough that sector alone is weak negative evidence.^1,2

Retained targeting includes Construction of Buildings, Food Manufacturing, Other Information Services, Monetary Authorities-Central Bank, and Credit Unions across United Arab Emirates, Argentina, Australia, and Bahrain; translate those sectors into the organization's exposed systems and high-value data.

The first briefing should connect outage, stolen data, and extortion leverage.^1,2

Align counsel, forensics, identity, recovery, insurance, communications, and regulatory analysis around one compromise timeline and one evidence-preservation plan.

Bottom Line Up Front

BLUF

Direwolf is tracked as a ransomware and extortion operation.¹

Treat the named ransomware as the visible impact component of a broader intrusion, not as proof of who performed every earlier action.

Initial access should be scoped across identity and Internet-facing systems.^1,2

The retained behavior points to credentials, remote access, phishing, or exposed services; preserve authentication, VPN, edge-device, email, and remote-administration evidence together.

The first detected host should not define the compromise boundary.¹

Check for earlier credential use, remote sessions, administrative changes, and data access because public actor records often understate the full pre-impact timeline.

Identity compromise is a central scoping issue.¹

Evidence includes credential or account abuse; response should cover privileged, service, remote-access, SaaS, and recovery identities—not just interactive user passwords.

The likely objective is control of high-value systems, including virtual infrastructure.¹

Lateral movement, administrative access, and hypervisor concentration can turn a limited foothold into broad business interruption.

Legitimate administration tools may carry much of the attack.¹

Security and recovery controls are part of the target set.¹

Defense impairment or evidence removal is retained in the source record. Protect immutable backups and investigate access to recovery systems before trusting them.

This is a data-breach problem as well as a recovery problem.¹

Collection or exfiltration behavior includes data staging and exfiltration; counsel and forensics need a shared record of what was accessed, staged, and transferred.

Victimology is broad enough that sector alone is weak negative evidence.^1,2

The first briefing should connect outage, stolen data, and extortion leverage.^1,2

Align counsel, forensics, identity, recovery, insurance, communications, and regulatory analysis around one compromise timeline and one evidence-preservation plan.

Decision Context

Executive Summary

Actor Card Detail

Actor Profile

Entity Type¹

Ransomware profile

First Seen¹

2025-05-27

Last Seen¹

2026-06-12

Origin¹

Motivation¹

Financially motivated ransomware/extortion

Primary Access Pattern¹

Not available

Objective¹

Financially motivated ransomware/extortion

Victimology

Named Victims / Public Disclosures

No named victim organizations are retained in the cited source artifacts for this profile. Countries and sectors are targeting context, not victim identities.

Identity

Aliases And Boundaries

Aliases¹

Source Boundary

SOCRadar is the retained baseline for this profile. IntelliOS preserves source labels as discovery and comparison signals until a cited source explicitly supports a merge, split, or actor-boundary change.

Targeting

Targets, Activity, And ATT&CK

Target Countries / Exposure^1,2

United Arab EmiratesArgentinaAustraliaBahrainBrazilCanadaChileColombiaCyprusGermanyDominican RepublicEgyptSpainFranceUnited KingdomHong KongHaitiIndonesiaIndiaItalyJapanMexicoMalaysiaNorwayPeruPhilippinesPakistanPortugalSingaporeThailandTunisiaTurkeyTaiwan, Province of ChinaUnited States

Target Sectors^1,2

Construction of BuildingsFood ManufacturingOther Information ServicesMonetary Authorities-Central BankCredit UnionsSoftware PublishersReal EstateHospitalsEnterprises & HoldingAccommodationManufacturingConstructionPublic AdministrationOil & GasEducational ServicesWholesale TradeData Processing ServicesRestaurantsInternet PublishingSpace & DefenseEnergy & UtilitiesInsurancePharmaceutical and Medicine ManufacturingPlastics Product ManufacturingMedical Equipment and Supplies ManufacturingLumber and Other Construction Materials Merchant WholesalersLegal ServicesRemediation and Other Waste Management ServicesColleges, Universities, and Professional SchoolsGrantmaking and Giving ServicesCivic and Social OrganizationsSemiconductor and Other Electronic Component ManufacturingNew Car DealersJewelry StoresFreight Transportation ArrangementMotion Picture and Video ProductionData Processing, Hosting, and Related ServicesPortfolio ManagementEngineering ServicesPublishing ServicesJustice & Safety ActivitiesAccommodation&Food ServicesChemical&Pharmaceutical ManufacturingMiningTelecommunicationsTransportation&WarehousingRetailAgriculture&ForestryElectrical&Electronical ManufacturingSea TransportationInformation ServicesComputer Design & ServicesBankingOtherFinanceProfessional&Technical ServicesHealthCare & Social AssistanceArts & EntertainmentRental & LeasingAdministrative & Support ServicesArchitectural ServicesIndustrial Machinery and Equipment Merchant WholesalersOffices of Certified Public AccountantsOffices of LawyersOther Accounting ServicesComputer Systems Design Services

Associated Activity¹

Execution & Defense Evasion: Presence of the marker file C:\runfinish.exe indicating prior encryption.Execution & Defense Evasion: Presence of the system-wide mutex Global\direwolfAppMutex, suggesting an active or recently executed Dire Wolf instance.Impact: Files encrypted with the .direwolf extension.Impact: Appearance of the ransom note HowToRecoveryFiles.txt on compromised systems.Defense Evasion: High-rate file modification events across user and shared data locations indicating mass encryption.Defense Evasion: Execution of commands to delete Volume Shadow Copies or backups (e.g., vssadmin delete shadows, wmic shadowcopy delete).Defense Evasion: Termination of the Windows Event Log service.Execution: Specific malware sample SHA256 hashes: 8fdee53152ec985ffeeeda3d7a85852eb5c9902d2d480449421b4939b1904aad (packed) or 27d90611f005db3a25a4211cf8f69fb46097c6c374905d7207b30e87d296e1b3 (unpacked).

ATT&CK IDs¹

Not available

Campaign Context

Associated Campaigns / Operations

No source-backed campaign or named operation association is currently retained for this actor card. Related campaign rows will appear here when SOCRadar, MITRE ATT&CK Campaigns, Microsoft, Google/Mandiant, CrowdStrike, CISA, or another retained public source ties the actor to a named campaign or operation.

Indicators

IOCs And Observable Retention

SOCRadar reported 7²IntelliOS retained 0

7 IOCs are reported by SOCRadar, but the underlying observable values are not yet retained in IntelliOS. The profile therefore cites the source count without republishing unstored IOC values.

Source coverage: 1 source group tracked; 0 currently contribute retained observable or context rows.

Retained Public Observables^1,2

7 IOCs are reported by SOCRadar, but the underlying observable values are not yet retained in IntelliOS. The profile therefore cites the source count without republishing unstored IOC values.

Source	Reported	Retained	Coverage Status
SOCRadar²	7	0	Reported IOC count retained; underlying SOCRadar feed values are not republished unless stored as cited public observables.

Actor Chronology

Observed Activity Timeline

No source-backed actor-activity dates are currently retained. Publication and record-maintenance dates are not promoted into activity dates.

IntelliOS Intel Products

Linked Products

None Found

Source Integrity AppendixSource reconciliation, citations, and collision-boundary analysisOpen

Source Reconciliation

How IntelliOS Keeps The Labels Straight

Source	Primary Name	Treatment	Boundary
SOCRadar	Direwolf	Baseline actor-card record retained for the current profile view.	Fields reflect the retained database record. Additional source consensus, collisions, and canonical identity mappings can be layered into this profile without automatically merging actors.
IntelliOS	Direwolf	Normalizes this record for directory search, card display, profile lookup, and future product linking.	Normalization is a presentation and workflow aid; it is not an independent attribution claim.

Open retained source profile

Source Collision Notes

Open Interpretation Boundaries

IntelliOS starts this detail page from the retained source record for Direwolf.

No possible same-actor, alias reuse, sub-cluster, duplicate-boundary, or external-source collision is currently retained for this actor.

Collision Source	Candidate Records	Shared Evidence	Treatment
None retained	No candidate records	No shared evidence recorded	No collision action needed.
External sources	Mandiant, CrowdStrike, other non-SOCRadar sources	None retained	External collisions are shown separately when retained.

Citations

Source Notes

#	Source	Use In Card
1	SOCRadar Threat Actor Database https://socradar.io/free-tools/threat-actor/ransomware	Threat actor directory source for profile fields and reported activity.
2	SOCRadar Actor Profile https://socradar.io/free-tools/ransomware-intelligence/groups/direwolf	Actor-specific source for ransomware profile metadata and reported IOC counts when available.

Loading Threat Actor Cards

Direwolf

Top 10 Talking Points

Direwolf is tracked as a ransomware and extortion operation.1

Initial access should be scoped across identity and Internet-facing systems.1,2

The first detected host should not define the compromise boundary.1

Identity compromise is a central scoping issue.1

The likely objective is control of high-value systems, including virtual infrastructure.1

Legitimate administration tools may carry much of the attack.1

Security and recovery controls are part of the target set.1

This is a data-breach problem as well as a recovery problem.1

Victimology is broad enough that sector alone is weak negative evidence.1,2

The first briefing should connect outage, stolen data, and extortion leverage.1,2

BLUF

Direwolf is tracked as a ransomware and extortion operation.1

Initial access should be scoped across identity and Internet-facing systems.1,2

The first detected host should not define the compromise boundary.1

Identity compromise is a central scoping issue.1

The likely objective is control of high-value systems, including virtual infrastructure.1

Legitimate administration tools may carry much of the attack.1

Security and recovery controls are part of the target set.1

This is a data-breach problem as well as a recovery problem.1

Victimology is broad enough that sector alone is weak negative evidence.1,2

The first briefing should connect outage, stolen data, and extortion leverage.1,2

Executive Summary

Actor Profile

Named Victims / Public Disclosures

Aliases And Boundaries

Targets, Activity, And ATT&CK

Associated Campaigns / Operations

IOCs And Observable Retention

Observed Activity Timeline

Linked Products

How IntelliOS Keeps The Labels Straight

Open Interpretation Boundaries

Source Notes

Direwolf is tracked as a ransomware and extortion operation.¹

Initial access should be scoped across identity and Internet-facing systems.^1,2

The first detected host should not define the compromise boundary.¹

Identity compromise is a central scoping issue.¹

The likely objective is control of high-value systems, including virtual infrastructure.¹

Legitimate administration tools may carry much of the attack.¹

Security and recovery controls are part of the target set.¹

This is a data-breach problem as well as a recovery problem.¹

Victimology is broad enough that sector alone is weak negative evidence.^1,2

The first briefing should connect outage, stolen data, and extortion leverage.^1,2

Direwolf is tracked as a ransomware and extortion operation.¹

Initial access should be scoped across identity and Internet-facing systems.^1,2

The first detected host should not define the compromise boundary.¹

Identity compromise is a central scoping issue.¹

The likely objective is control of high-value systems, including virtual infrastructure.¹

Legitimate administration tools may carry much of the attack.¹

Security and recovery controls are part of the target set.¹

This is a data-breach problem as well as a recovery problem.¹

Victimology is broad enough that sector alone is weak negative evidence.^1,2

The first briefing should connect outage, stolen data, and extortion leverage.^1,2