Description Summary
Golang double-extortion group; 75 victims across 30 countries.
Threat Actor
Double extortion; anti-analysis + anti-recovery (kills backups, deletes logs).
Technical Indicators
Encryption Extension
.direwolf
Encryption Algorithm
ChaCha20 + Curve25519 (per-file keys); Golang, UPX-packed
Ransom Note Name
Not publicly reported
Targeted Industries
Manufacturing, Professional services, Healthcare
First Seen
May 2025
Last Seen
Active (75 victims)
Geographical Location
Global (30 countries)
MITRE ATT&CK Matrix
| Tactic | TTP | Technique Name |
|---|---|---|
| Impact x 2 | T1486 | Data Encrypted for Impact |
| T1490 | Inhibit System Recovery | |
| Exfiltration x 1 | T1567 | Exfiltration Over Web Service (leak site) |
| Initial Access x 2 | T1190 | Exploit Public-Facing Application |
| T1078 | Valid Accounts |