Dire Wolf Ransomware Targets Windows, Wipes Logs and Backups

According to GBHackers On Security, the DireWolf ransomware group emerged in May 2025 and has since infected 16 organisations across 16 regions, including the United States, Thailand, Taiwan, Australia and Italy, demanding multimillion-dollar ransoms in Bitcoin through its preferred Tox messenger channel.

The operators publicly disclosed their initial six victims on 26 May 2025 via a darknet leak site, signalling full‑scale operations and a strict financial motive, backed by a double‑extortion scheme that threatens to leak stolen data if payments are not made. The campaign targets Windows systems worldwide and employs ruthless measures to wipe event logs, erase backups and thwart recovery, including terminating the Windows Event Log service and deleting volume shadow copies and backups.

Its encryption process excludes essential system folders and certain files to keep the OS bootable, using Curve25519‑ChaCha20 with per‑file private keys and a marker file C:\runfinish.exe to prevent re‑encryption; it also notes victims with a HowToRecoveryFiles.txt and uploads stolen data to a public file‑sharing site. Mitigations suggested by the report include offline backups, restricted privileges, monitoring for abnormal termination of processes and multi‑factor authentication on backup consoles.