Dire Wolf
A double extortion ransomware group first seen in May 2025. Its malware stops security and backup services, kills event logging and removes recovery options before encrypting.
Threat actor profile. Last reviewed 3 November 2026.
Why It Matters
Singapore's Cyber Security Agency issued an alert on the campaign in August 2025, saying the group mainly targets manufacturing and technology and uses anti-forensics to evade detection and hinder recovery.5 AhnLab also lists construction and finance among victim sectors.4
The malware is built to make recovery and investigation harder. Trustwave and AhnLab describe it stopping services tied to antivirus, backup and database products, repeatedly killing the Windows event log process, deleting shadow copies and backups, and clearing event logs.2,4
The sources we reviewed do not establish a UK link. Trustwave says the group claims to be based in New York and does not consider that credible.2
Because logging is attacked directly, we would send logs off the host in real time. Evidence kept only on the victim machine may not survive.
How It Attacks
Based on malware analysis by Trustwave and AhnLab.2,4 These cover the payload. Reconnaissance and lateral movement were not known at the time of Trustwave's report.
- 1
Check Before Running
Looks for signs of a previous run and exits if it finds them.
- 2
Stop Defences and Backups
Stops a hardcoded list of services and repeatedly ends applications tied to security, backup and databases.
- 3
Blind the Logs
Repeatedly kills the event log process and clears Application, System, Security and Setup logs.
- 4
Remove Recovery
Deletes shadow copies and Windows backups and disables the recovery environment.
- 5
Encrypt
Encrypts local and network drives, then forces a reboot and deletes itself.
- 6
Extort
Posts samples of stolen data, then gives about a month before releasing everything.
Key Techniques
Our mapping of the behaviour Trustwave and AhnLab describe.2,4 ATT&CK v20 has no entry for this group.
| ID | Technique | Tactic | What It Looks Like |
|---|---|---|---|
| T1027.002 | Software Packing | Stealth | Binary packed with UPX. |
| T1489 | Service Stop | Impact | Stops services including backup and database products. |
| T1685 | Disable or Modify Tools | Defense Impairment | Stops services tied to antivirus products. |
| T1685.005 | Clear Windows Event Logs | Defense Impairment | Clears the main Windows event logs. |
| T1490 | Inhibit System Recovery | Impact | Deletes shadow copies and backups and disables recovery. |
| T1486 | Data Encrypted for Impact | Impact | Encrypts local and network drives. |
| T1529 | System Shutdown/Reboot | Impact | Forces a reboot after encryption. |
| T1070.004 | File Deletion | Stealth | Deletes its own executable. |
Tools Observed
Built-in Windows Tools Abused
From Trustwave and AhnLab.2,4 These are normal Windows tools, so finding one does not prove compromise. Look at how and when they run.
Vulnerabilities
The sources we reviewed do not tie a CVE to Dire Wolf.
Key Events
The group appears and posts its first victims to a leak site.4
Trustwave publishes a detailed analysis.2
Singapore's Cyber Security Agency issues an alert.5
Bitdefender places the group in its top 10 and reports a rise after two quieter months.1 Cyber Daily reports a new claim against an Australian company, which had not responded at publication.3
Warning Signs
Drawn from the malware analysis.2,4 Any of these on a server deserves an immediate check.
- Many backup, database and security services stopped at once
- The Windows event log service repeatedly ending
- Event logs cleared across several categories
- Shadow copies or Windows backups deleted, or the recovery environment disabled
- An unexpected forced reboot shortly after the above
Defences That Matter
Protect Your Backups
- Keep multiple backups and test them regularly.5
- Keep at least one copy offline or immutable, because the malware deletes local backups.
Watch for the Prelude
- Review event and security logs for suspicious activity.5
- Send logs to a central platform so that clearing a host does not erase the evidence.
Contain Fast
- Apply controls that detect and contain ransomware.5
- Enable tamper protection so that security services cannot be stopped easily.
Would Your Logs Survive an Attack?
We can help you test whether your backups and logging would hold up against this kind of malware.
Sources
- Bitdefender: Threat Debrief, September 2026, 8 September 2026
- Trustwave SpiderLabs (LevelBlue): Dire Wolf Strikes: New Ransomware Group Targeting Global Sectors, 24 June 2025
- Cyber Daily: Exclusive: Source code potentially compromised in Aussie game dev data breach, 19 August 2026
- AhnLab ASEC: Dire Wolf Ransomware: Threat Combining Data Encryption and Leak Extortion, 1 September 2025
- Cyber Security Agency of Singapore: Ongoing Dire Wolf Ransomware Campaign, AL-2025-082, 18 August 2025
MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK terms of use.