ransomware

DireWolf

active · last signal 25d agoAttribution: ModeratePlausible and partly corroborated — some gaps or single-source elements.

Ransomware

Dire Wolf

Attribution

Unattributed financially-motivated ransomware operation. No public reporting links DireWolf to a named APT, nation-state, or a specific pre-existing ransomware family/lineage. The operators claimed a New York (US) location in their ransom note, but vendors (Trustwave SpiderLabs/LevelBlue) assess this as likely false/misdirection. True origin is unknown.

First seen

2025-05

Last active

2026-09

Motivation

Financial (extortion). The group publicly states its only goal is money, with no stated political or ideological objectives.

Attribution confidence

medium

MENA targeting

UAE

Sectors

Professional services

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

Why it mattersRansomware actor, medium confidence, documented targeting UAE (Professional services sector).

What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.

Associated with

Related to

NovaactorTechnique overlap
BrainCipheractorTechnique overlap
TenguactorTechnique overlap
Cicada3301actorTechnique overlap
SpacebearsactorTechnique overlap
The GentlemenactorTechnique overlap
LynxactorTechnique overlap
RansomHubactorTechnique overlap
Sinobiactor

Coverage robustness · vs this actor

How evasion-resistant our detection coverage is against DireWolf's techniques — Summiting the Pyramid scores analytics (1 brittle – 5 robust); the actor inherits through its TTPs. This is a detection-engineering metric, not an attribution signal — see Attribution for confidence.

Techniques with a robust rule

Techniques with any detection

10 / 14

Mean robustness (of covered)

Claimed victims · 3 tracked

Leak-site postings via ransomware.live — claimed by the group, not confirmed breaches. Metadata only. MENA Ransomware Watch →

Claim volume · last 12 months

ONDJFMAMJJAS

Date	Victim	Country	Sector

Useful?