Direwolf
Direwolf is a ransomware group with a financial motive, tracked by Brandefense. It targets 15 sectors, including Government and Technology, in 26 countries, including the United States and the United Kingdom. It uses 20 MITRE ATT&CK techniques.
- Techniques
- 20
- Exploited CVEs
- No CVE data
- First seen
- May 1, 2025
- Last seen
- Sep 8, 2026
- Record updated
Who They Target.
Sectors · 15
Countries · 26
Labelsbdef-qf:latest
About Direwolf.
Dire Wolf is a sophisticated human-operated ransomware group first documented in May 2025, written in Golang using Curve25519/ChaCha20 encryption, targeting manufacturing and technology sectors across 13+ countries with ransoms up to $500,000, operated by a tight core team rather than a broad affiliate program.
Last updated Oct 1, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.