direwolf
Activity analysis
HackerFeeds has tracked 142 victims claimed by direwolf since April 2025, most recently in November 2026 — ranking #55 of 332 groups (0.4% of all tracked ransomware victims). It posted 67 victims in the last 90 days, up 1575% on the previous 90 days (4). Its most-targeted sector is Technology (23 victims), followed by Healthcare (21). The United States accounts for 34 victims (25% of those with a known location); 4 victims did not disclose a location.
Victims per year
- 202559
- 202683
Top sectors
- Technology23
- Healthcare21
- Manufacturing17
- Financial Services13
- Business Services12
- Professional Services6
Top countries
Computed from victims claimed on the group's leak site as collected by HackerFeeds; claims are not independently verified. Monthly reports · Methodology
Group profile
Dire Wolf is a sophisticated human-operated ransomware group first documented in May 2025, written in Golang using Curve25519/ChaCha20 encryption, targeting manufacturing and technology sectors across 13+ countries with ransoms up to $500,000, operated by a tight core team rather than a broad affiliate program.
Recent victims
No victims tracked yet.