Dire Wolf Ransomware Targets Windows, Wipes Logs and Backups

The recently emerged DireWolf ransomware group has launched a sophisticated new campaign targeting Windows systems worldwide, employing ruthless tactics to delete event logs, erase backup-related data, and thwart recovery efforts.

First sighted in May 2025, DireWolf has rapidly escalated its operations, infecting 16 organizations across 16 regions—including the United States, Thailand, Taiwan, Australia, and Italy—and demanding multimillion-dollar ransoms in Bitcoin through its preferred Tox messenger channel.

On May 26, 2025, DireWolf publicly disclosed its initial six victims via a darknet leak site, signaling the start of its full-scale operations.

Unlike many ransomware outfits, DireWolf explicitly states that its sole objective is financial gain, and it relies on a double-extortion scheme: encrypting critical corporate data and threatening to publicly leak it unless victims pay up.

Targets span diverse industries—manufacturing, IT, construction, finance—underscoring the group’s indiscriminate approach.

DireWolf’s executable is parameterized via command-line arguments, dispensing with configuration files entirely.

Operators may specify a target directory with the -d flag or view help with -h. Upon execution, the ransomware first checks for the mutex Global\direwolfAppMutex and the presence of the marker file C:\runfinish.exe.

If either exists, the program logs the event, self-deletes, and exits to avoid redundant encryption.

Failing that, a two-second pause precedes the launch of a worker pool sized at eight times the number of logical CPUs.

By spawning that many concurrent goroutines, DireWolf saturates I/O wait times, dramatically accelerating file processing at the cost of high CPU usage and increased disk queues.

To impede detection and recovery, DireWolf repeatedly terminates the Windows Event Log service (eventlog) via WMI queries and taskkill, ensuring logs cannot be generated or retrieved.

It then issues a looped sequence of “check PID → force close → wait → repeat,” perpetually blocking log collection even if the service restarts.

Next, the ransomware obliterates Volume Shadow Copies and scheduled backups using built-in Windows utilities: vssadmin delete shadows /all /quiet, wbadmin stop job -quiet, and wbadmin delete backup -keepVersions:0 -quiet.

It disables the Windows Recovery Environment with bcdedit /set {default} recoveryenabled No and prevents boot-into-recovery with bcdedit /set {default} bootstatuspolicy ignoreallfailures. Finally, wevtutil cl commands purge Application, System, Security, and Setup logs.

Furthermore, DireWolf force-terminates key processes—SQL Server, Oracle, Exchange, VMware, Veeam, Veritas BackupExec, Symantec, and Sophos—alongside services like BackupExecJobEngine, SQLSERVERAGENT, wuauserv, VeeamTransportSvc, and MSExchangeIS.

This pre-encryption purge of database, backup, and security components paralyzes standard recovery and monitoring mechanisms.

Encryption Mechanics

During the encryption phase, DireWolf either processes a specified directory or all local and network drives (excluding CD/ROM).

It excludes essential system folders—AppData, Windows, Program Files, $Recycle.Bin, System Volume Information—and critical files like bootmgr, ntldr, and NTUSER.DAT, plus its ransom note HowToRecoveryFiles.txt.

Executables (.exe), DLLs (.dll), drivers (.sys, .drv), and disk images (.iso, .img) are also spared to ensure the OS remains bootable and can display the ransom demand.

A per-file random private key is used in a Curve25519 key exchange with a hard-coded DireWolf public key.

The resulting shared secret is hashed via SHA-256 to derive both the ChaCha20 encryption key and nonce.

Small files (<1 MB) are fully encrypted; larger files (>1 MB) have only their first megabyte encrypted to maximize throughput while delivering forensic damage.

Once encryption concludes, DireWolf writes a C:\runfinish.exe marker to prevent re-encryption, then schedules an immediate system reboot with cmd /c start shutdown -r -f -t 10.

Concurrently, a self-deletion routine triggers via timeout /T 3 followed by del, ensuring the malware executable vanishes—complicating forensic recovery.

Every encrypted folder receives a “HowToRecoveryFiles.txt” note containing the victim’s room ID and username, evidence of an earlier breach.

To prove data exfiltration, DireWolf also uploads stolen files to a public file-sharing site, coercing ransoms with the threat of mass leaks.

Mitigations

Despite its youth, DireWolf demonstrates advanced ransomware tactics—Curve25519-ChaCha20 encryption, systemic anti-recovery strategies, and robust self-defense mechanisms. Organizations in manufacturing, IT, construction, finance, and beyond face acute risk. Effective countermeasures include:

• Regular offline backups and immutable snapshots.
• Restricting administrative privileges and WMI access.
• Continuous monitoring for abnormal process terminations.
• Multi-factor authentication on backup consoles.

Until defensive strategies adapt to these sophisticated attacks, DireWolf will continue to pose a severe global threat to Windows environments.

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.