ransomware

DireWolf

active · last signal 25d agoAttribution: ModeratePlausible and partly corroborated — some gaps or single-source elements.

Ransomware

Dire Wolf

Attribution

Unattributed financially-motivated ransomware operation. No public reporting links DireWolf to a named APT, nation-state, or a specific pre-existing ransomware family/lineage. The operators claimed a New York (US) location in their ransom note, but vendors (Trustwave SpiderLabs/LevelBlue) assess this as likely false/misdirection. True origin is unknown.

First seen

2025-05

Last active

2026-09

Motivation

Financial (extortion). The group publicly states its only goal is money, with no stated political or ideological objectives.

Attribution confidence

medium

MENA targeting

UAE

Sectors

Professional services

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

Why it mattersRansomware actor, medium confidence, documented targeting UAE (Professional services sector).

What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.

Associated with

Related to

NovaactorTechnique overlap
BrainCipheractorTechnique overlap
TenguactorTechnique overlap
Cicada3301actorTechnique overlap
SpacebearsactorTechnique overlap
The GentlemenactorTechnique overlap
LynxactorTechnique overlap
RansomHubactorTechnique overlap
Sinobiactor

Observed techniques

14 distinct

Rows marked inferred are OSINT-extracted enrichment for actors without a MITRE Group ID — treat as analyst assessment, not authoritative ATT&CK attribution.

Technique	Name	Tactic	Observed use
T1070.004 ↗inferred	File Deletion	Defense Evasion	Self-deletes after encryption via cmd /C timeout /T 3 & del /f /q to reduce forensic footprint (Trustwave, ASEC).
T1027.002 ↗inferred	Software Packing	Defense Evasion	Trustwave SpiderLabs: Golang encryptor packed with UPX to hinder static analysis (packed SHA-256 8fdee531...).
T1562.002 ↗inferred	Disable Windows Event Logging	Defense Evasion	Continuous loop locates the eventlog service process via WMI and terminates it with taskkill /f /pid to stop logging during encryption (Trustwave, ASEC).
T1070.001 ↗inferred	Clear Windows Event Logs	Defense Evasion	wevtutil cl run against Application, System, Security and Setup logs (Trustwave, ASEC).
T1562.001 ↗inferred	Disable or Modify Tools	Defense Evasion	Stops and disables antivirus services (Sophos, Symantec, Qihoo 360) among 75 hard-coded services via ControlService, sc stop and sc config start= disabled.
T1059.003 ↗

Useful?

Regional co-occurrence · associated techniques

Honesty note

Regional co-occurrence is association, not prediction. These techniques appeared alongside DireWolf's activity across the tracked MENA roster — a TIE-style association computed on our corpus (not CTID's model), not a prediction of the next move. Ranked by support-adjusted lift (over-representation among actors like this one vs. the roster base rate, damped when few actors back it), so neither a merely-common technique nor a tiny-sample coincidence floats to the top. A hunting lead only; never recorded as observed. ICS techniques are excluded.

T1083assoc T1135assoc T1021.001assoc T1680assoc T1491.001assoc T1021.002assoc T1566assoc T1685assoc

Defensive coverage · Microsoft 365

Which Microsoft 365 controls protect, detect, or respond to this actor's techniques — from the CTID Mappings Explorer (technique-level). Strength: significant / partial / minimal.

protect · 8 techniques

App GovernanceT1562significantDefender for Cloud AppsT1133partialDefender for Cloud AppsT1567partialRole Based Access ControlT1059minimalRole Based Access ControlT1562minimalAntimalwareT1027significantAntimalwareT1059significantAntimalwareT1059.001significantAudit SolutionsT1562partialInformation ProtectionT1070significantInformation ProtectionT1070.001significantInformation ProtectionT1567significant

detect · 9 techniques

App GovernanceT1562significantAdvanced Threat HuntingT1562significantAdvanced Threat HuntingT1567significantDefender for Cloud AppsT1133partialDefender for Cloud AppsT1486partialDefender for Cloud AppsT1567partialMicrosoft Defender for IdentityT1047minimalMicrosoft Defender for IdentityT1059minimalMicrosoft Defender for IdentityT1059.001minimalMicrosoft Defender for IdentityT1133minimalSecure ScoreT1562minimalSecure ScoreT1567minimalIdentity Secure ScoreT1133partialAudit Solutions

respond · 5 techniques

Automated Investigation and ResponseT1567significantIncident ResponseT1059minimalIncident ResponseT1562minimalQuarantine PoliciesT1027significantZero Hour Auto PurgeT1027significantZero Hour Auto PurgeT1059significantZero Hour Auto PurgeT1059.001significant

DireWolf

Observed techniques

Regional co-occurrence · associated techniques

Defensive coverage · Microsoft 365

Countermeasures · D3FEND