DireWolf Ransomware Threat Report

Affected Environment
Windows environments across professional services, manufacturing, healthcare, technology, and financial services, with heavy reliance on on-premises backup and database infrastructure.

Threat Overview
DireWolf is a human-operated, double-extortion ransomware group with a tight core team, no confirmed links to Akira, Fog, Qilin, or SafePay, and an accelerating leak-site cadence.

Exposure Timeline
First attack 17 April 2025, first leak-site disclosures 26 May 2025, 100 confirmed victims by 19 August 2026, 25 of those in the past month alone.

Attack Surface
Exposed RDP and VPN services, credential-based access, and suspected spear-phishing entry points, with no confirmed CVE exploitation to date.

Technical Root Cause
Golang, UPX-packed encryptor using per-file Curve25519 key exchange, SHA-256 key derivation, and ChaCha20 encryption, with size-based partial encryption to maximise throughput.

Exploitation Pathway
Attacker gains initial access via credentials or phishing, dwells for days to weeks, then runs a scripted sequence that disables logging, destroys backups and shadow copies, kills recovery-relevant processes, and encrypts files before rebooting and self-deleting.