DireWolf: The New Ransomware Group Targeting Global Businesses

DireWolf, a ransomware group that emerged in May 2025, has rapidly developed into a global threat, with victims reported across manufacturing, IT, construction and finance sectors in Asia, Australia, Italy, the United States, Thailand and Taiwan. According to AhnLab, on 26 May 2025 they disclosed their first six victims on a darknet leak site, marking the start of their full-fledged activities.

The group employs a double extortion model, encrypting critical files while threatening to leak stolen data, and claims to be financially motivated, communicating with victims via the encrypted Tox messenger. So far, AhnLab confirms that 16 organisations in 16 regions have fallen victim to their attacks.

DireWolf uses a hybrid encryption scheme combining Curve25519 key exchange with the ChaCha20 cipher, with each file receiving a unique key and a .direwolf extension appearing on encrypted files, alongside a ransom note titled HowToRecoveryFiles.txt. It also deploys anti-recovery measures such as self-deletion, stopping Windows Event Log services, and deleting shadow copies and backups.