In August 2026, attackers behind the Dire Wolf ransomware said they had breached 100 organizations across 32 countries, and by October 5, 2026 the leak site listed 136 victims, according to Picus Security and Proven Data.
The ransomware’s encryptor is a Go‑written, UPX‑compressed program that relies on the ChaCha20 cipher (a stream cipher). Before encrypting files, the malware turns off Windows logging, removes shadow copies using vssadmin and wmic, wipes event logs with wevtutil, disables recovery options via bcdedit, and halts backup and security services. For every targeted file, the ransomware creates a distinct ChaCha20 key by performing a Curve25519 exchange and then hashing the result with SHA-256. Most infections hit professional services, manufacturers, healthcare providers, tech firms and financial institutions.
One report notes the first known incident occurred on 17 April 2025, while another says the threat appeared in May 2025. In Aug. 2026, the actors said they had breached 100 organizations across 32 nations. By October 5, 2026, the leak site showed 136 victims that had been publicly named, including 12 newly listed in the prior month.
Detection rule validation
Defenders should watch for the exact commands the ransomware runs before encryption: vssadmin delete shadows /all /quiet, wevtutil cl Application (and the same for System, Security, Setup logs), and any unauthorized stopping of services. A basic script can mimic these defensive‑impairment actions by making a temporary file, executing the vssadmin and wevtutil commands, and then removing the file with cmd /c del.
Incident response playbook updates
When teams find an infection in a healthcare organization, they should separate the compromised hosts to protect essential services, look at event logs (if they remain) and verify backup integrity before starting broader incident response.
Backup resilience recommendations
To make backups more resilient, keep them apart with distinct administrator accounts, choose immutable or offline media, and routinely practice restoring from them.
Red‑team testing with simulation platforms
The Picus Platform provides pre‑built Dire Wolf simulations for endpoint, network and email channels that let organizations test their defenses. AttackIQ’s Ransom Tales collection contains a Dire Wolf emulation that covers the startup mutex check, defensive‑impairment steps, encryption and self‑deletion to validate controls.
CSA guidance and overall defensive posture
The Cyber Security Agency recommends watching for IOCs, examining event and security logs, keeping several verified backups, and using suitable security controls to spot and block Dire Wolf activity. By combining detection rule tuning, updated IR playbooks, resilient backup practices, and regular red‑team testing with the available simulations, organizations can validate and strengthen their defenses against the Dire Wolf ransomware strain.
Join the discussion