Dire Wolf Ransomware Disrupts Recovery and Encrypts Files Before Extorting Victims
Summary
Dire Wolf ransomware steals data before encrypting Windows systems, disables logging and recovery options, and threatens to publish stolen data. The article details its techniques and describes Picus simulations for testing defenses.
Key points
- The group claimed 100 victims across 32 countries by August 2026, with victims concentrated in professional services, manufacturing, healthcare, technology, and finance.
- Suspected initial access includes phishing, exposed RDP or VPN services, compromised credentials, and third-party access; no specific CVE exploitation is linked.
- Operators reportedly spend days to weeks inside victim environments and steal data before encryption; described incidents averaged about 265 GB exfiltrated.
- Before encrypting files, the malware terminates and clears Windows Event Logs, deletes shadow copies and backups, disables recovery settings, and stops selected services.
- The Go-based Windows encryptor uses Curve25519, SHA-256, and ChaCha20, encrypting files fully below 1 MB and only their first 1 MB above that size.
- It appends .direwolf to encrypted files, drops a ransom note, forces a reboot, and deletes its executable.
Article Details
- Attack Vectors
- Suspected initial access methods include spearphishing attachments, exposed RDP or VPN services, compromised accounts, and access through a third party or managed service provider; the article says these routes remain uncertain.
- After gaining access, operators spend days to weeks in the victim environment and steal sensitive data before encrypting files.
- Defensive Notes
- Test security controls against Dire Wolf using the Picus Platform's Windows Endpoint, Network Infiltration, and E-mail Infiltration threat simulations.
- Monitor for attempts to terminate the Windows Event Log service, clear event logs, delete Volume Shadow Copies and backups, alter boot recovery settings, stop security and recovery-related processes or services, and force a reboot.
- Investigate execution of vssadmin, wmic, wbadmin, bcdedit, wevtutil, taskkill, and shutdown commands associated with the described recovery-disruption and cleanup behavior.
MITRE ATT&CK
T1021.001 · Remote Desktop ProtocolExposed RDP services are listed as a suspected initial-access route.T1021.004 · SSHExposed VPN services are listed as a suspected initial-access route.T1078 · Valid AccountsCompromised accounts are cited as a suspected initial-access route.T1485 · Data DestructionAfter encryption, the malware uses del commands to remove its executable from disk.T1486 · Data Encrypted for ImpactDire Wolf encrypts victim files, fully encrypting files below 1 MB and encrypting the first 1 MB of larger files.T1489 · Service StopThe malware forcibly stops processes and services associated with databases, mail, virtualization, backup, and security software.T1490 · Inhibit System RecoveryThe malware deletes shadow copies and backups and disables Windows Recovery to impede recovery.T1562.002 · Disable Windows Event LoggingThe malware terminates the process hosting the Windows Event Log service and clears Application, System, Security, and Setup logs.T1566.001 · Spearphishing AttachmentSpearphishing attachments are cited as a suspected initial-access route.T1567 · Exfiltration Over Web ServiceThe operators steal sensitive data before encryption and threaten to publish it on a Tor-hosted leak site.
Threat Actors
Malware
Vendors
Products
Microsoft WindowsBefore encryption, Dire Wolf kills the Event Log service, deletes shadow copies and backups, and disables Windows Recovery.Picus PlatformThe Picus Platform simulates Dire Wolf Ransomware across endpoint, network, and email attack modules to test security controls.Windows Server BackupThe malware then targets Windows Server Backup with wbadmin [1]:
Tools
bcdeditDire Wolf changes boot settings through bcdedit to inhibit automatic recovery:shutdownThe ransomware then schedules a forced reboot with shutdown:taskkillIt uses WMI queries to find the process hosting the Windows Event Log service, then repeatedly terminates it with taskkill.UPXIts Go-based, UPX-packed encryptor gives every file a unique ChaCha20 key derived through Curve25519 and SHA-256, and encrypts only the first 1 MB of larger files for speed.vssadminIt uses both vssadmin and wmic for this purpose:wbadminThe malware then targets Windows Server Backup with wbadmin [1]:wevtutilThe malware later uses wevtutil cl to clear the Application, System, Security, and Setup logs:wmicIt uses both vssadmin and wmic for this purpose:
Countries
BrazilBy August 2026, it had claimed 100 victims across 32 countries, including the United States and Brazil, mainly in professional services, manufacturing, healthcare, technology, and financial services.United StatesBy August 2026, it had claimed 100 victims across 32 countries, including the United States and Brazil, mainly in professional services, manufacturing, healthcare, technology, and financial services.
Industries
Financial ServicesBy August 2026, it had claimed 100 victims across 32 countries, including the United States and Brazil, mainly in professional services, manufacturing, healthcare, technology, and financial services.HealthcareBy August 2026, it had claimed 100 victims across 32 countries, including the United States and Brazil, mainly in professional services, manufacturing, healthcare, technology, and financial services.ManufacturingBy August 2026, it had claimed 100 victims across 32 countries, including the United States and Brazil, mainly in professional services, manufacturing, healthcare, technology, and financial services.Professional ServicesBy August 2026, it had claimed 100 victims across 32 countries, including the United States and Brazil, mainly in professional services, manufacturing, healthcare, technology, and financial services.TechnologyBy August 2026, it had claimed 100 victims across 32 countries, including the United States and Brazil, mainly in professional services, manufacturing, healthcare, technology, and financial services.