Dire Wolf Ransomware Targets Windows, Wipes Logs and Backups

DireWolf Ransomware Group: Technical Analysis and Mitigation Strategies

The DireWolf ransomware group has launched a new campaign targeting Windows systems globally. The group has developed techniques to delete event logs, erase backup data, and hinder recovery processes.

First identified in May 2025, DireWolf has attacked 16 organizations across different regions, including the United States, Thailand, Taiwan, Australia, and Italy. The group demands ransoms in Bitcoin through the Tox messenger channel.

DireWolf employs a double-extortion model: encrypting data and threatening to leak it unless a ransom is paid. Target industries include manufacturing, IT, construction, and finance.

The ransomware executable uses command-line arguments and avoids configuration files. It checks for the mutex Global\direwolfAppMutex and the file C:\runfinish.exe to prevent redundant encryption.

Upon execution, a worker pool is initiated with a size of eight times the number of logical CPUs, optimizing I/O wait times and accelerating file processing.

DireWolf stops the Windows Event Log service repeatedly via WMI queries and taskkill commands. This prevents log generation and retrieval. The ransomware also deletes Volume Shadow Copies and scheduled backups using Windows utilities such as vssadmin and wbadmin .

Services related to database, backup, and security components are force-terminated to hinder recovery efforts.

The ransomware encrypts files using a Curve25519 key exchange and ChaCha20 encryption. Files under 1 MB are fully encrypted, while larger files have only the first megabyte encrypted.

A marker file C:\runfinish.exe is created post-encryption to prevent re-encryption. The malware then schedules a system reboot and deletes itself to complicate forensic analysis.

To counter DireWolf's advanced tactics, organizations can implement the following measures:

Regular offline backups and immutable snapshots. Restrict administrative privileges and WMI access. Monitor for abnormal process terminations. Use multi-factor authentication on backup consoles.

These steps can help mitigate the risks posed by DireWolf, which continues to be a significant threat to Windows systems around the world.

Based on reporting by GBHackers.