Direwolf

Inactive
Dire Wolf is a sophisticated human-operated ransomware group first documented in May 2025, written in Golang using Curve25519/ChaCha20 encryption, targeting manufacturing and technology sectors across 13+ countries with ransoms up to $500,000, operated by a tight core team rather than a broad affiliate program.
135 Victims
Apr 16, 2025 First Discovered
Sep 11, 2026 Last Discovered
5 Days Inactive
0% Infostealer
0/1 Sites Online
Known Locations (1)
DireWolf
direwolfcdkv5whaz2spehizdg22jsuf5aeje4asmetpbt6ri4jnd4qd.onion
Intelligence
Victims (135)

Detailed victim list temporarily unavailable

This group has 135 victims. The victim list API is currently responding slowly for this dataset. Country, sector, and infostealer breakdowns are not available at this time. Basic stats (victim count, first/last seen) are shown above from a faster data source.