THREAT ACTOR
DIREWOLF_
DormantDIREWOLF is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of DIREWOLF, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
Victims by year
- 2026 78
- 2025 59
Leak site mirrors
3 mirrors tracked, 0 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
direwolfcdkv5whaz2spehizdg22jsuf5aeje4asmetpbt6ri4jnd4qd.onionDireWolf snapshot · 2026-09-22 23:17 -
direwolfgpyqohwxwoetsz7a6p72diu32c3wfysqdx4ei6bwft7zh3yd.onionFile Browser snapshot · 2026-09-13 19:01 -
direwolf66s5zealav7azcyqeipiswecvvnapyuby3dek473kyqfucad.onionDireWolf Negotiation System - Login snapshot · 2026-09-23 00:17
Recent victims
The 50 most recent victims claimed by DIREWOLF. Total in the index: 137.
| Date listed | Victim | Description |
|---|---|---|
| 2026-09-14 | Little Otter | |
| 2026-09-14 | Hazel Health | |
| 2026-09-11 | Port of Tanjung Pelepas | |
| 2026-09-09 | RelyComply AML Platform | |
| 2026-09-09 | Sales Boomerang | |
| 2026-09-08 | EMS1R | |
| 2026-09-07 | TrainMe | |
| 2026-09-07 | Precision Vehicle Logistics | |
| 2026-09-07 | Lightcast | |
| 2026-09-07 | Semper Laser | |
| 2026-09-06 | eAssist Dental Solutions | |
| 2026-09-06 | Mission Pet Health | |
| 2026-09-06 | myLaurel | |
| 2026-09-04 | Wolfram Research | |
| 2026-09-02 | Cartrack Holdings | |
| 2026-09-02 | PTT Oil and Retail Business | |
| 2026-09-01 | Honeycomb Programs Inc | |
| 2026-09-01 | PT Intraco Penta Tbk | |
| 2026-09-01 | Oportunidados | |
| 2026-08-30 | THQ Nordic | |
| 2026-08-30 | Erdem Hospital | |
| 2026-08-30 | Hospital Clnico Universidad de Chile | |
| 2026-08-25 | National Kidney Registry | |
| 2026-08-25 | Studio Legale ESE | |
| 2026-08-21 | NorthStar | |
| 2026-08-21 | Aztec Software | |
| 2026-08-21 | The Revel Collective | |
| 2026-08-21 | ProSim Aviation Research | |
| 2026-08-21 | Authenticate Information Systems | |
| 2026-08-21 | Diaco Global | |
| 2026-08-21 | iSON XPERIENCES | |
| 2026-08-21 | Deer Creek-Mackinaw CUSD | |
| 2026-08-21 | Allstar Industries | |
| 2026-08-21 | HP Carriers | |
| 2026-08-21 | MCT Group of Companies | |
| 2026-08-21 | Reviso Cloud Accounting Limited | |
| 2026-08-21 | Studee | |
| 2026-08-19 | Photon Health, Inc. | |
| 2026-08-19 | InfoFlo CRM | |
| 2026-08-19 | PayUp | |
| 2026-08-19 | Lifesum | |
| 2026-08-17 | Mighty Kingdom | |
| 2026-08-17 | Eva AI Limited | |
| 2026-08-17 | Arizona State University (ASU) | |
| 2026-08-17 | Wishfully Studios | |
| 2026-08-15 | TOTVS | |
| 2026-08-15 | Colla Health | |
| 2026-08-15 | PayrHealth | |
| 2026-08-15 | DXS International | |
| 2026-08-15 | DodoPayments |
CONFIRMED ATTACKS
Direwolf confirmed attacks: 8 verified incidents
Ransomnews has verified 8 Direwolf incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from May 2025 to September 2026. Malaysia accounts for 1 of them (13%), with victims recorded in 8 countries in total. The most affected sector is transportation, at 1 confirmed victim. Where a figure was disclosed (1 case), these incidents account for 146 exposed records.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Direwolf incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| September 2026 | Port of Tanjung Pelepas | Transportation | Gelang Patah, Malaysia | — | Unknown | Source |
| August 2026 | Cartrack | Technology | Johannesburg, South Africa | — | Unknown | Source |
| August 2026 | Dodo Payments | Finance | Karnataka, India | — | Unknown | Source |
| August 2026 | Statista GmbH | Other | Hamburg, Germany | — | Unknown | Source |
| July 2025 | Universidad Mayor | Education | Santiago, Chile | — | Unknown | Source |
| June 2025 | Mitachi (HK) Co., Ltd. | Manufacturing | Kowloon, Hong Kong | — | Unknown | Source |
| May 2025 | DataPost | Service | Singapore, Singapore | 146 | Unknown | Source |
| May 2025 | Legal Practice Board of Western Australia | Government | Perth, Australia | — | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Direwolf's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.