Dire Wolf ransomware

Dire Wolf (also written DireWolf) is a double-extortion ransomware group active since May 2025. Its Go-built Windows encryptor appends .direwolf to each file ( invoice.pdf becomes invoice.pdf.direwolf ) and writes HowToRecoveryFiles.txt into every folder it finishes. The note opens with "Dear Mr or Ms", states that the network was compromised, data leaked and files encrypted, and supplies a live-chat room ID, username and password that the operators hard-code per victim, so each sample is built for one target. It promises three days of silence if contact is made and warns that the stolen files go public after 30 working days. Claimed victims span manufacturing, IT, construction, finance, healthcare and professional services across Asia, Australia, Europe and North America. Before encrypting, the binary stops database, backup, virtualization and security processes, clears Windows event logs, deletes shadow copies and backup catalogs, uses a mutex named Global\direwolfAppMutex, and deletes itself afterward. Files are encrypted with a per-file Curve25519 key exchange feeding ChaCha20. No relationship to an earlier family has been documented.

File extensions: .direwolf

Ransom note filenames: HowToRecoveryFiles.txt

Decryptor: No public decryptor was found. Checked 2026-10-28.

Data exfiltration risk: Likely — The note claims data was leaked and supplies a proof sample, and the group posts victims on its leak site; no advisory has documented the transfer method.

Systems typically targeted: Windows servers and workstations

Do this first: Preserve a copy of HowToRecoveryFiles.txt and any surviving binary immediately, because the encryptor deletes itself and clears event logs.