Dire Wolf
Dire Wolf is a ransomware operation first observed in 2025 and described as a new Golang-based ransomware threat. Reporting states it has impacted victims in 11 countries and uses double extortion, encrypting victim data while also threatening to publish exfiltrated information. Separate reporting also notes file-wiping behavior. Dire Wolf has been tracked as an emerging ransomware group in 2025, including in industrial-sector ransomware reporting, and was listed among newly identified groups affecting industrial organizations. Multiple sources characterize it as part of a broader 2025 trend in which newer ransomware groups increasingly relied on data theft and leak-site extortion, in some cases without deploying ransomware lockers. Dire Wolf launched a dark web leak site in 2025; one report said the site initially listed four victims, while another source noted the group had recorded roughly 10 to 13 incidents. High-confidence details in the provided content do not specify precise infection vectors, malware family lineage, or technical indicators of compromise beyond its Golang implementation, double-extortion model, leak-site activity, and reported file-wiping behavior.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
2 distinct techniques documented for this family, organized by ATT&CK tactic.
Recent activity
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A ransomware family that appeared in 2025, using identity-based access vectors for initial compromise.
Extortion-focused group that conducts data theft and leak-based extortion attacks, often without deploying traditional ransomware encryption.
Ransomware operation referenced as a mid-volume group impacting industrial sectors.
Double-extortion ransomware that encrypts victim data and threatens to leak exfiltrated data unless ransom is paid.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.