DireWolf Ransomware Decryption & Data Recovery

DireWolf - written "Dire Wolf" in most reporting - was first publicly documented by Trustwave SpiderLabs in May 2025. The first batch of victims appeared on its leak site in late May 2025, with some incidents traced back to attacks in April 2025. The operators describe themselves as purely financially motivated with no political stance. The encryptor is written in Go and shipped UPX-packed, and the operation is plainly human-operated: intrude, reconnoitre, exfiltrate, then detonate across the estate at once.

Unlike broad affiliate programmes such as LockBit or Qilin, public analysis points to DireWolf being run directly by a small core team with no open affiliate recruitment. Each build is tailored to one victim - the live-chat roomID, username and password are hard-coded into the sample, which means a manual targeting and packaging step precedes deployment. Demands have reached the USD 500,000 range in single incidents.

From roughly a dozen victims in 2025 to more than 130 named organisations across a dozen-plus countries and territories by September 2026 - trackers count this differently, so figures vary by platform and date - DireWolf has moved from newcomer to leak-site regular in little more than a year. Healthcare, professional services, technology, manufacturing and financial services dominate. Geographically, alongside the United States and Brazil there is a pronounced concentration in Asia-Pacific - Malaysia, Thailand, Singapore and Taiwan.

No public report confirms a targeted campaign against mainland China organisations. For Chinese groups with plants or branches in Southeast Asia, however, the target space overlaps closely with their own overseas footprint.

One gap must be stated honestly: DireWolf's initial access has never been fully confirmed in any public report. Every vendor account of it is inference drawn from victim post-mortems.

Extension. The full original filename is kept and .direwolf is appended, so report.xlsx becomes report.xlsx.direwolf. Names are neither rewritten nor randomised, and the extension is the same for every victim rather than per-target.

Ransom note. HowToRecoveryFiles.txt is dropped in affected directories. The English text states that the network was breached, critical data stolen and files encrypted, offers a limited window before disclosure - public reporting does not record a consistent number of days, so go by the note actually received - and supplies a victim-specific live-chat roomID, username and password plus a qTox ID. A free file-hosting link (typically gofile.io) usually accompanies it, pointing to a sample pack of stolen files as proof.

Host artefacts.

• Mutex Global\direwolfAppMutex, used to prevent re-execution.
• A marker file named runfinish.exe written to the root of the C: drive once encryption completes.
• Application, System, Security and Setup event logs cleared via wevtutil.
• The Windows Event Log service terminated, alongside roughly 75 hard-coded services and 59 processes covering security products, databases and office suites.
• The encryptor self-deletes after execution, so the original sample is frequently gone by the time anyone investigates.

Exclusions (relevant to both attribution and recovery). AppData, Windows, Program Files, $Recycle.Bin and System Volume Information are skipped, as are bootmgr, ntldr and NTUSER.DAT, and the extensions .exe, .dll, .sys, .drv, .iso and .img. The machine therefore still boots and the desktop looks normal - only business files fail to open. That appearance of normality is exactly why many organisations delay reporting and keep using the host, destroying evidence in the process.

Bottom line. The .direwolf extension together with HowToRecoveryFiles.txt is enough to attribute the family. The recovery plan, however, depends on the file-size distribution and which regions were overwritten, so real samples must be analysed before any conclusion is drawn.

DireWolf's initial access step has never been fully confirmed in public reporting, and this remains the family's largest intelligence gap. The vectors below are vendor inferences from victim post-mortems and should be treated as investigative leads rather than established fact:

• Spear-phishing carrying malicious attachments or links.
• Abuse of internet-facing VPN, RDP and remote-access appliances. No public report ties this family to a named vendor product or a specific CVE, and at least one vendor states plainly that no documented exploitation has been observed.
• Valid account logins to RDP, VPN or remote management tooling, using credentials from password reuse, infostealer logs or dark-web purchases.
• Indirect compromise through third-party providers and the supply chain.

Post-compromise behaviour is far better documented. Operators use living-off-the-land tooling - PowerShell, WMI, PsExec - to map the network, harvest credentials and move laterally. Dwell time runs to several days or more - public analysis gives no consistent figure - exfiltration is concentrated before encryption, and the encryptor is then pushed to many hosts at once during a business trough. Because victim-specific chat credentials are hard-coded into the build, a manual packaging step must occur before deployment, which means defenders have a meaningful detection window between reconnaissance and detonation.

The practical lesson is that this crew does not rely on zero-days. It relies on ordinary weaknesses: VPN and RDP without MFA, unpatched edge appliances, backup consoles sharing domain credentials, and remote management tools that anyone can install. Those are the highest-yield places to look and to harden.

Algorithms. Curve25519 key exchange against a hard-coded operator public key, combined with ChaCha20 stream encryption; the shared secret is run through SHA-256 to derive the working key and nonce, and every file gets its own session key. No implementation flaw has been found in public reversing, and without the operators' private key nothing can be reversed.

Partial encryption - the defining technical trait. Files under 1 MB are encrypted in full. Files larger than 1 MB have only their first 1 MB encrypted, with the remainder left untouched. The design is a speed optimisation, but it has a specific consequence: header metadata, database boot pages, virtual disk descriptors and partition structures are destroyed, while the bulk of large files survives intact. Recovery prospects therefore split sharply by file type and size, and quantifying that split is the first step in any recovery plan.

Recovery inhibition.

• vssadmin delete shadows /all /quiet removes every volume shadow copy.
• wbadmin deletes Windows Backup images and bcdedit disables recovery options.
• Roughly 75 hard-coded services are terminated, covering security products such as Sophos, Symantec and Qihoo 360 as well as database and backup services including SQLServerAgent, MSExchangeIS, VeeamTransportSvc and BackupExecJobEngine - the point is to release exclusively-locked database and mail files so they can be encrypted.
• About 59 processes are killed, event logs are cleared, and the binary self-deletes when finished.

Platform. As of September 2026 public analysis has only observed a 64-bit Windows encryptor, and at least one vendor states explicitly that no Linux or ESXi build exists. That is a point-in-time judgement: if the crew ships a Linux or ESXi encryptor, the assessment below must be revisited immediately. Damage in virtualised estates therefore usually comes from files being encrypted inside guest VMs rather than the hypervisor datastore being locked wholesale - a distinction with real value during assessment, and one to verify immediately.

Double extortion. Data is exfiltrated before encryption and a sample pack is linked from the note as proof. Non-payment leads to staged publication on the Tor leak site - public reporting gives no consistent interval before full release - alongside direct pressure on the victim's customers and partners. Volumes vary by incident and must be established from actual traffic and logs rather than estimated from precedent.