DireWolf Ransomware Activity Intensifies

Executive Summary

DireWolf is a ransomware operation that first appeared in May 2025. After remaining relatively quiet for an extended period, DireWolf significantly increased its activity in August 2026, when it added 43 new victims to its leak site. The group's publicly identified victims span multiple geographic regions, with the largest number located in the United States.

Technical analysis of a DireWolf ransomware sample identified several capabilities designed to facilitate successful encryption and impair recovery. The ransomware uses Curve25519-based key exchange combined with ChaCha20 to encrypt files and appends the .direwolf extension to encrypted files. It creates a HowToRecoveryFiles.txt ransom note in affected directories and provides victims with a sample of stolen data hosted on Gofile as evidence of access to their files.

The ransomware also implements extensive defense-impairment functionality. During analysis, the sample repeatedly used taskkill.exe to forcibly terminate processes associated with Microsoft Exchange, SQL and other database software, Microsoft Office, email clients, synchronization applications, and other services. It additionally disables the Volume Shadow Copy Service and Windows Update, manipulates backup functionality, deletes recovery-related data, and clears Windows Event Logs. These actions are intended to reduce interference with encryption, inhibit recovery, and limit the availability of forensic evidence.

The combination of a dedicated ransomware payload, extensive pre-encryption process termination, recovery inhibition, data-leak extortion, and dedicated negotiation infrastructure demonstrates an established operational capability. The sharp increase in publicly identified victims during August 2026 indicates that DireWolf's activity had expanded substantially after its earlier period of limited visibility.

DireWolf Threat Actor

In May 2025 DireWolf ransomware first appeared, when the group published six initial victims, marking its public emergence. The group emerged during a period of significant disruption within the ransomware ecosystem following law-enforcement actions against established ransomware operations, including LockBit and Ghost.

The group operates a financially motivated ransomware campaign and has reportedly demanded ransoms of up to $500,000 from victims.

Following its initial emergence, DireWolf remained relatively quiet for an extended period. However, the group significantly increased its activity in August 2026, when it added 43 new victims to its leak site. This increase represents a substantial escalation in the group's publicly observed activity compared with the preceding period.

DireWolf's victims are geographically distributed across multiple regions. Among the identified victims, the United States accounts for the largest number, with 32 organizations, followed by Malaysia (11), Thailand (9), Brazil (8), and the United Kingdom (7). The distribution indicates that the group does not restrict its operations to a single geographic region and has targeted organizations across North America, Asia, Europe, and South America.

The significant increase in victim postings during August 2026 indicates that DireWolf has transitioned from relatively limited public activity to a more active operational phase. The combination of a dedicated leak site, ransom demands of up to $500,000, and geographically diverse victim targeting demonstrates an established ransomware operation capable of conducting campaigns against organizations across multiple regions.

Ransomware Functionality

Defense Impairment

The DireWolf ransomware implements multiple mechanisms designed to impair system defenses, disrupt recovery capabilities, and terminate processes that could interfere with file encryption. The observed behavior includes extensive process termination using the native Windows taskkill.exe utility, disabling Windows services, removing backup and shadow-copy data, and clearing Windows Event Logs.

A prominent component of the defense-impairment routine is the repeated execution of taskkill.exe.

Runs in an infinite loop (30-second interval). Kills 59 processes via taskkill /F /IM <name>:

The targeted processes span several functional categories. The sample attempts to terminate Microsoft Exchange services, including MSExchangeIS.exe, MSExchangeTransport.exe, MSExchangeMailboxAssistants.exe, MSExchangeRepl.exe, MSExchangeRPC.exe, and MSExchangeServiceHost.exe. It also targets database-related processes such as Sqlservr.exe, sqlagent.exe, sqlwriter.exe, sqlbrowser.exe, oracle.exe, dbeng50.exe, dbsnmp.exe, and dbsrv12.exe.

The process list additionally includes applications that commonly maintain open handles to user data, including Microsoft Office applications (excel.exe, winword.exe, outlook.exe, powerpnt.exe, msaccess.exe, mspub.exe, onenote.exe, and visio.exe), email clients such as thunderbird.exe and thebat.exe, and synchronization software including onedrive.exe. By terminating these processes before encryption, DireWolf can reduce file-locking conflicts and increase the number of files available for encryption.

Full list … Appendix A

The ransomware also targets services associated with virtualization, backup, and data-management software.

Categories: Backup software (Veeam, BackupExec, Arcserve, Wbadmin), AV/Security (Sophos, Symantec RTVscan/SavRoam/ccEvtMgr, zhudongfangyu), Databases (MSSQL ×many, QuickBooks), Exchange Server, VMware, Windows Update (wuauserv), VSS.

Full list … Appendix B

Among the observed targets are vss.exe, sqlwriter.exe, and several application-specific services. This behavior is particularly relevant to ransomware operations because active backup and database processes can interfere with encryption or provide mechanisms for restoring affected data.

In addition to terminating processes, the malware modifies Windows service configuration. It executes:

sc config wuauserv start= disabled
sc config vss start= disabled

This disables the Windows Update service and the Volume Shadow Copy Service (VSS), respectively. Disabling VSS is particularly significant because shadow copies can provide a local mechanism for recovering files after ransomware encryption. The Triage analysis also observed interaction with deletion of shadow copies, providing an additional recovery-inhibition mechanism.

The sample further uses wbadmin.exe to disable regular backups and delete system-state backups and the backup catalog. The combination of backup deletion, VSS manipulation, and process termination indicates that the ransomware attempts to eliminate multiple potential recovery mechanisms before or during the encryption process.

DireWolf also attempts to impair forensic visibility by clearing Windows Event Logs. The sample invokes wevtutil.exe and accesses a broad range of .evtx files, including the Security, System, PowerShell, Windows Backup, WMI Activity, Terminal Services, and other operational logs.

Besides that, the ransomware contains a function named Check_Sign(), which acts as a single-instance and already-executed guard. It first checks for the presence of C:\runfinish.exe, a marker file created at the end of a successful execution. If the file exists, DireWolf assumes that the system has already been encrypted and terminates with an "already run" error, preventing a second encryption attempt.

If the marker file is absent, Check_Sign() converts the string Global\direwolfAppMutex to UTF-16 and calls OpenMutexW() to determine whether another DireWolf instance is already running. If the mutex exists, the malware closes the handle and terminates with a "have running" error. Only when neither condition is met does it call Create_Sign() to create the named mutex and proceed with the encryption routine.

1. Check_Sign:
   • Checks the marker file C:\runfinish.exe (if it exists, returns “execute finish”)
   • Attempts to call OpenMutexW with MUTEX_ALL_ACCESS (0x1f0001) - if a mutex already exists, returns “have running”
   • Otherwise, calls Create_Sign to create the mutex; if that fails - log.Printf, Delete_Self, os.Exit(1)
2. Create_Sign:
   • Converts “Global\direwolfAppMutex” to UTF-16
   • Calls CreateMutexW(NULL, FALSE, lpName)
   • If GetLastError() == ERROR_ALREADY_EXISTS - closes the handle and returns “have running”
   • Otherwise, stores the handle in g_hMutexInstance

This mechanism prevents concurrent instances from interfering with each other and provides C:\runfinish.exe and Global\direwolfAppMutex as potential host-based detection artifacts.

Overall, the sample demonstrates a comprehensive defense-impairment strategy in which process termination is combined with service manipulation and recovery-data destruction. This behavior increases the likelihood that files will be accessible for encryption while simultaneously reducing the victim's ability to recover affected data or reconstruct the attack from local Windows telemetry.

Encryption

DireWolf implements a hybrid cryptographic scheme that combines Curve25519-based key exchange with the ChaCha20 stream cipher for file encryption. This combination enables the ransomware to establish encryption keys using Curve25519 while using ChaCha20 for the encryption of victim files.

For every file, encryptFile() reads 32 fresh random bytes to use as an ephemeral X25519 scalar. It computes the ephemeral public key via scalarBaseMult and, separately, a shared secret via scalarMult(ephemeral_scalar, PubKey) — that PubKey constant is the attacker's hardcoded public key baked into the binary. The 32-byte shared secret is hashed twice with SHA-256 (sha256(sha256(secret))) to produce the ChaCha20 key. Encryption itself uses golang.org/x/crypto/chacha20's unauthenticated cipher. It also only encrypts up to 1 MB of each file, a common ransomware speed optimization, meaning files larger than 1 MB are only partially encrypted.

After encryption, affected files are renamed with the .direwolf extension, providing a direct artifact for identifying files processed by the ransomware.

DireWolf subsequently creates a ransom note named HowToRecoveryFiles.txt in each affected directory. The note provides instructions for contacting the operators and includes a link to a sample document hosted on the public file-sharing service Gofile:

hxxps://gofile[.]io/d/3ffbuJ

The linked document is used as proof of access to the victim's files, demonstrating that the operators obtained data from the compromised environment. By providing a sample of the stolen information, the attackers seek to reinforce their data-leak threat and increase pressure on the victim during ransom negotiations.

For communication with victims, DireWolf operates a dedicated negotiation website where victims can authenticate using credentials or access tokens. The group also maintains a Tor-based website at:

hxxp://direwolfcdkv5whaz2spehizdg22jsuf5aeje4asmetpbt6ri4jnd4qd[.]onion

The combination of ChaCha20-based file encryption, the .direwolf extension, per-directory ransom notes, and proof-of-access material hosted through Gofile forms part of DireWolf's extortion workflow. The dedicated negotiation infrastructure provides the operators with a separate channel through which victims can communicate and negotiate ransom payments.

Outlook

DireWolf's significant increase in publicly identified victims during August 2026, following a prolonged period of limited activity, indicates an expansion of the group's operational activity. The combination of geographically diverse targeting, ransom demands, and dedicated negotiation and leak-site infrastructure provides the group with an established framework for continued ransomware operations.

The analyzed ransomware demonstrates mature capabilities for both file encryption and defense impairment, including Curve25519 and ChaCha20-based encryption, extensive process termination, recovery inhibition, and event-log manipulation. These capabilities allow DireWolf to disrupt victim environments while limiting available recovery and forensic options.

Organizations should prioritize controls capable of detecting pre-encryption activity, particularly abnormal process termination, attempts to disable VSS and backup services, recovery-data deletion, and Windows Event Log manipulation. Maintaining regular, isolated, and tested backups can significantly reduce the impact of ransomware by providing an alternative means of recovering encrypted data. Backup infrastructure should be protected from the same administrative credentials and network access used by production systems, with offline or otherwise isolated copies maintained to prevent ransomware from compromising backups alongside primary systems.

Appendix

Appendix A

wxServerView.exe, sqlmangr.exe, RAgui.exe, supervise.exe, Culture.exe,
Defwatch.exe, httpd.exe, wsa_service.exe, synctime.exe, vxmon.exe,
sqlbrowser.exe, memtas.exe, tomcat6.exe, Sqlservr.exe, agntsvc.exe,
dbeng50.exe, dbsnmp.exe, dbsrv12.exe, encsvc.exe, excel.exe, firefox.exe,
vss.exe, infopath.exe, isqlplussvc.exe, msaccess.exe, mspub.exe,
mydesktopqos.exe, mydesktopservice.exe, ocautoupds.exe, ocomm.exe,
ocssd.exe, onenote.exe, oracle.exe, outlook.exe, powerpnt.exe,
sqbcoreservice.exe, sql.exe, steam.exe, tbirdconfig.exe, thebat.exe,
thunderbird.exe, visio.exe, WinSAT.exe, winword.exe, wordpad.exe,
onedrive.exe, wrapper.exe, xfssvccon.exe, sqlservr.exe, sqlagent.exe,
sqlwriter.exe, MSExchangeIS.exe, MSExchangeTransport.exe,
MSExchangeMailboxAssistants.exe, MSExchangeRepl.exe, MSExchangeRPC.exe,
MSExchangeServiceHost.exe, notepad++.exe, notepad.exe

Appendix B

AcrSch2Svc, backup, BackupExecAgentAccelerator, BackupExecAgentBrowser,
BackupExecDiveciMediaService, BackupExecJobEngine, BackupExecManagementService,
BackupExecRPCService, BackupExecVSSProvider, CAARCUpdateSvc, CASAD2DWebSvc,
ccEvtMgr, ccSetMgr, DefWatch, GxBlr, GxCIMgr, GxCVD, GxFWD, wuauserv, GxVss,
Intuit.QuickBooks.FCS, memtas, mepocs, PDVFSService, QBCFMonitorService,
QBFCService, QBIDPService, RTVscan, SavRoam, sophos, sql, stc_raw_agent,
veeam, VeeamDeploymentService, VeeamNFSSvc, VeeamTransportSvc, VSNAPVSS, vss,
YooBackup, YooIT, zhudongfangyu, SQLPBDMS, SQLPBENGINE, MSSQLFDLauncher,
SQLSERVERAGENT, MSSQLServerOLAPService, SSASTELEMETRY, SQLBrowser,
SQLServerDistributedReplayClient, SQLServerDistributedReplayController,
MsDtsServer150, SSISTELEMETRY150, SSISScaleOutMaster150, SSISScaleOutWorker150,
MSSQLLaunchpad, SQLWriter, SQLTELEMETRY, MSSQLSERVER, BackExecRPCService,
bedbg, Culserver, dbeng8, MSExchange, msftesql-Exchange, msmdsrv, MSSQL,
sqladhlp, SQLADHLP, sqlagent, SQLAgent, SQLAgent$SHAREPOINT, tomcat6,
vmware-converter, vmware-usbarbitator64, WSBExchange

Indicators of Compromise

Type	Value
Urls	https://gofile.io/d/3ffbuJ
Onion Domains	direwolf3ddtab5anvhulcelauvoxu2a7l264hqs6vtxtgrqsjfvodid.onion
	direwolfcdkv5whaz2spehizdg22jsuf5aeje4asmetpbt6ri4jnd4qd.onion
	direwolf66s5zealav7azcyqeipiswecvvnapyuby3dek473kyqfucad.onion
	direwolfgpyqohwxwoetsz7a6p72diu32c3wfysqdx4ei6bwft7zh3yd.onion
TOX ID	B344BECDC01A1282F69CB82979F40439E15E1FD1EF1FE9748EE467F5869E2148E6F1E55959E2
File Hashes	f0a85f105fa178ffa862bd3fdbc6b7ec642dd46189a10e14786c802fac8978e9
	950031040990dcac28adeb03f0c0ebbef3e31c8666a5d6573741489280c18216
	aae2393a1567f38f86ff133e0c023d9cd9f8e3565dbdabd413448c433c2ed537
	e97be7d5f5a9f43b9f6215d012d4378065dde445c593b62d7e4f4008193fe51a
	b6fa7a34b57803d2b80f3f484656d34997231597b6c1aa7fc8a386d6474c8afe