Hunt / direwolf
direwolf
67victims, 90d
Nov 6last post
0reports about them
-techniques with a rule
0indicators
Nothing published that we can read says how direwolf gets in or what it runs once inside. This page is who they hit, and that is all we have. If you know of a public write-up, it belongs here.
Who they hit
| Posted | Victim | Country |
|---|---|---|
| 2026-11-06 | Algonomy | US |
| 2026-11-03 | USClaims | US |
| 2026-11-01 | My Cloud Grocer | GB |
| 2026-10-27 | GRUPO PETROIL | MX |
| 2026-10-13 | Interseguro | PE |
| 2026-10-04 | Softruck | BR |
| 2026-10-04 | Softruck | BR |
| 2026-09-11 | Port of Tanjung Pelepas | MY |
| 2026-09-09 | RelyComply AML Platform | GB |
| 2026-09-08 | Sales Boomerang | US |
| 2026-09-08 | EMS1R | US |
| 2026-09-07 | Precision Vehicle Logistics | US |
Latest 12 of 67, from ransomware.live. These are the group's claims.
Confirmed elsewhere
Victims of direwolf that a second, independent source also named inside two weeks. How convergence works.
- 2026-10-22 Photon Health leak + litigation + notice
Sweep
No indicators. Either nobody has published any for direwolf, or the reports cite values without marking them as IOCs. package.json