Dark Web Profile: Dire Wolf Ransomware

According to SOCRadar, Dire Wolf emerged in 2025 and quickly carried out disruptive ransomware attacks in multiple regions, with the group appearing on dark web leak sites within weeks of its public debut. The threat group is described as financially motivated, operating a double extortion model that includes data theft, encryption, and a threat to publish stolen data on a Tor leak site.

In May 2025 the group publicly surfaced, and it claimed 41 victims worldwide, with initial disclosures highlighting targets in Thailand, Taiwan, Singapore, and the United States. Its ransom notes, titled HowToRecoveryFiles.txt, provide victim-specific credentials for a Tor negotiation portal, and negotiations are conducted via Tox. The group states on its leak site that it is “Based in New York, NY,” though analysts consider this unverified; a reported ransom demand in at least one case was around 500,000 USD.

Dire Wolf prefers a targeted, manually deployed approach rather than automated worm-like spread, and it encrypts files with a hybrid scheme while offering a short confidentiality window before data is leaked.