DireWolf
DireWolf is a ransomware group first reported as emerging in May 2025, with first victim postings on its leak site reported on May 26, 2025. Reporting cited in the provided content describes it as quickly demonstrating mature extortion operations, including structured victim posting and double extortion tactics. A later August 28, 2025 deep-dive referenced in the content reported about 39 confirmed victims through August 2025. Victim geography in the provided reporting spans more than 11 countries, with concentration in Singapore, Thailand, the Philippines, and Taiwan. Additional reporting in the content states DireWolf claimed multiple victims in Malaysia. Sector-focused reporting from Cyfirma says Direwolf showed one of the highest levels of focus on the energy and utilities industry among ransomware groups with meaningful victim counts. Specific incidents mentioned in the content include a ransomware attack against a Pakistani automobile assembly and sales company and an attack on Universidad Mayor in Chile, for which the DireWolf group took credit. The content associates DireWolf with a malicious domain used in campaigns or social engineering: tor-browser[.]io, including subdomains such as www, sitemap, and sitemaps. The group is also listed among newer or newly prominent ransomware groups observed in 2025. No nation-state attribution is provided in the supplied content. Known alias in the content: direwolf / DireWolf.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Energy
- Utilities
Tradecraft
2 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Recent activity
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named as a ransomware crew that emerged in 2025; no additional details provided.
Ransomware group referenced for claiming multiple victims in Malaysia; associated victims in the regional summary were largely manufacturing organizations.
Ransomware group showing focused attention on the energy and utilities sector.
Ransomware operation that rapidly achieved mature double-extortion processes and structured leak-site victim posting; reported Asia-heavy victim concentration.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.