Dire Wolf Ransomware: Threat Combining Data Encryption and Leak Extortion
Sept. 3, 2025, 8:14 p.m.
Description
The DireWolf ransomware group emerged in May 2025, targeting various industries globally. They employ a double extortion technique, encrypting data and threatening leaks. The ransomware uses Curve25519 key exchange and ChaCha20 encryption, generating unique keys for each file. It implements anti-recovery measures, terminating backup processes, deleting logs, and disabling recovery environments. The malware encrypts files, creates ransom notes, and self-deletes after scheduling a system reboot. DireWolf's sophisticated approach, combining encryption, anti-analysis techniques, and data leakage threats, poses a significant risk to organizations across sectors.
Tags
Date
- Created: Sept. 3, 2025, 5:31 p.m.
- Published: Sept. 3, 2025, 5:31 p.m.
- Modified: Sept. 3, 2025, 8:14 p.m.
Indicators
- 7f877830ebafb0b809b96bac7baf4435e235ab7835f695006ff779e6178c3638
- 27d90611f005db3a25a4211cf8f69fb46097c6c374905d7207b30e87d296e1b3
Additional Informations
- Construction
- Technology
- Finance
- Manufacturing
- Australia
- Taiwan
- Italy
- Thailand
- United States of America