DIREWOLF Ransomware: 6 Victims in 5 Days — Cross-Sector Campaign Hits US Tech, Thai Energy, and Global Manufacturing

Classification: TLP:CLEAR | Report Date: 2026-09-05 | Source: Dark web leak site monitoring via ransomware.live

Executive Summary

Security Arsenal's dark web monitoring has confirmed a sharp escalation in DIREWOLF ransomware activity. Between 2026-09-01 and 2026-09-04, the group posted six new victims to its .onion leak site — a posting cadence of roughly 1.5 victims per day, well above its historical baseline. The victim set spans five countries (US, ZA, TH, BR, ID) and five distinct sectors, indicating a broad, opportunistic campaign rather than vertical-focused targeting. The presence of a critical-infrastructure operator (PTT Oil and Retail Business, Thailand) among the victims elevates this campaign's risk profile for energy and utilities defenders globally.

Organizations running Check Point Security Gateways, ConnectWise ScreenConnect, or Microsoft Exchange on-premises should treat this bulletin as actionable immediately — all three products appear in the CISA KEV entries correlated with this actor's activity window.

Threat Actor Profile — DIREWOLF

DIREWOLF follows the mature post-2023 ransomware playbook: compromise an edge device, establish persistence, conduct internal recon, harvest credentials, stage data for exfiltration to attacker-controlled cloud storage, then deploy the encryptor domain-wide via PsExec/WMI or Group Policy. The group demonstrates operational discipline — its leak posts follow a predictable pressure cadence (teaser post → data sample → full dump deadline).

Current Campaign Analysis

Recent Victimology (Leak Site Confirmed)

Key Observations

Sector spread: Technology, transportation, energy, and manufacturing in a single wave signals access-broker-driven opportunism — affiliates are detonating whatever access is available, not running a vertical playbook. The inclusion of PTT Oil and Retail Business is the most strategically significant event: energy-sector compromises carry heightened regulatory, safety, and geopolitical implications.

Geography: No single-country concentration. US victims remain the highest-value extortion targets, but the ZA/TH/BR/ID spread reflects DIREWOLF's willingness to extort organizations with historically lower payment rates — consistent with volume-over-value affiliate economics.

Victim profile: Mid-market to enterprise. PT Intraco Penta Tbk and Cartrack Holdings are publicly listed; Wolfram Research and PTT OR are large private/state-linked enterprises. Revenue range across the set is estimated at USD $50M–$2B+.

Posting cadence: 6 posts in 5 days is an acceleration. Escalation patterns like this typically precede either (a) a larger wave as affiliates burn through stockpiled access, or (b) a deliberate publicity push to attract new affiliates after a competitor group's disruption.

CVE Correlation — Likely Initial Access Vectors

CISA KEV entries with confirmed ransomware use overlapping this campaign window:

• CVE-2026-50751 — Check Point Security Gateway improper authentication (IKEv1). Edge-VPN auth bypass is a classic DIREWOLF entry point. If your Check Point gateways are unpatched, assume exposure.
• CVE-2024-1708 — ConnectWise ScreenConnect path traversal → RCE. RMM tooling abuse aligns with the group's observed hands-on-keyboard tradecraft and mid-market victim profile (MSP/RMM-heavy environments).
• CVE-2023-21529 — Microsoft Exchange deserialization. Plausible secondary access vector against the enterprise victims in this wave.
• CVE-2025-60710 — Windows link-following privilege escalation. Consistent with post-compromise privilege escalation rather than initial access.
• CVE-2026-48027 — Nx Console embedded malicious code. Supply-chain vector; relevant to technology-sector victims with developer workstations in scope.

Assessment (moderate confidence): CVE-2026-50751 (Check Point) and CVE-2024-1708 (ScreenConnect) are the most probable initial access vectors for this wave based on actor TTP alignment and exploitation timelines.

Detection Engineering

The following detections target DIREWOLF's known playbook: edge-VPN/RMM initial access, PsExec/WMI lateral movement, and pre-encryption data staging.

---
title: DIREWOLF Ransomware - PsExec or WMI Remote Service Execution
id: 8f3a2c1e-direwolf-0001-4b7a-9e2f-1a2b3c4d5e01
status: production
description: Detects remote service creation via PsExec-style named pipes or WMI process spawn consistent with DIREWOLF lateral movement and encryptor deployment
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
  category: process_creation
  product: windows
detection:
  selection_psexec:
    Image|endswith:
      - '\PSEXESVC.exe'
      - '\psexec.exe'
    CommandLine|contains:
      - '-accepteula'
      - '\\'
  selection_wmi:
    ParentImage|endswith: '\WmiPrvSE.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\rundll32.exe'
  selection_remotesvc:
    EventID: 7045
    ServiceFileName|contains:
      - 'ADMIN$'
      - 'PSEXESVC'
  condition: selection_psexec or selection_wmi or selection_remotesvc
falsepositives:
  - Legitimate administrative tooling; baseline by admin host and service account
level: high
tags:
  - attack.lateral_movement
  - attack.t1021
  - attack.t1569.002
  - attack.t1047
---
title: DIREWOLF Ransomware - Pre-Encryption Data Staging and Exfiltration
id: 8f3a2c1e-direwolf-0002-4b7a-9e2f-1a2b3c4d5e02
status: production
description: Detects mass archive creation and cloud-storage exfiltration tooling (rclone, 7z mass compression) used by DIREWOLF affiliates before encryption detonation
author: Security Arsenal Threat Intelligence
logsource:
  category: process_creation
  product: windows
detection:
  selection_tools:
    Image|endswith:
      - '\rclone.exe'
      - '\7z.exe'
      - '\7za.exe'
      - '\winrar.exe'
      - '\rar.exe'
  selection_args:
    CommandLine|contains:
      - ' -a '
      - ' -r '
      - ' copy '
      - ' sync '
      - 'mega'
      - 'dropbox'
      - 'password'
  filter_legit:
    CommandLine|contains:
      - 'C:\\Program Files\\7-Zip'
  condition: selection_tools and selection_args and not filter_legit
falsepositives:
  - Backup software and IT archiving; whitelist known backup service accounts and paths
level: high
tags:
  - attack.collection
  - attack.t1560.001
  - attack.exfiltration
  - attack.t1567.002
---
title: DIREWOLF Ransomware - Edge VPN or RMM Exploitation Followed by Suspicious Child Process
id: 8f3a2c1e-direwolf-0003-4b7a-9e2f-1a2b3c4d5e03
status: production
description: Detects child processes spawned by Check Point gateway services, ScreenConnect, or Exchange IIS worker processes — indicators of edge exploitation consistent with CVE-2026-50751, CVE-2024-1708, and CVE-2023-21529
author: Security Arsenal Threat Intelligence
logsource:
  category: process_creation
  product: windows
detection:
  selection_parents:
    ParentImage|endswith:
      - '\ScreenConnect.Service.exe'
      - '\ScreenConnect.ClientService.exe'
      - '\w3wp.exe'
      - '\umservice.exe'
  selection_children:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\net.exe'
      - '\whoami.exe'
  condition: selection_parents and selection_children
falsepositives:
  - Exchange health probes spawning whoami; filter by service account and parent command line
level: critical
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059
date: 2026/09/05

Microsoft Sentinel KQL — Lateral Movement & Pre-Ransomware Staging Hunt

This query hunts the 48–72 hour pre-detonation window: suspicious remote execution followed by mass file access or archive tooling, pivoted on non-admin hosts talking to many internal targets in a short period.

// DIREWOLF pre-ransomware staging hunt: remote exec + mass file activity + archive tooling
let lookback = 14d;
let staging_window = 3d;
let SuspectHosts =
    DeviceProcessEvents
    | where Timestamp > ago(lookback)
    | where InitiatingProcessFileName =~ "WmiPrvSE.exe"
       or FileName in~ ("psexec.exe", "PsExec64.exe", "PSEXESVC.exe", "rclone.exe", "7z.exe", "7za.exe", "rar.exe")
    | summarize FirstSeen = min(Timestamp), Toolset = make_set(FileName), CmdLines = make_set(ProcessCommandLine) by DeviceName, AccountName
    | project DeviceName, AccountName, FirstSeen, Toolset, CmdLines;
SuspectHosts
| join kind=inner (
    DeviceNetworkEvents
    | where Timestamp > ago(staging_window)
    | where RemotePort in (445, 139, 3389, 5985, 5986)
    | where RemoteIP startswith "10." or RemoteIP startswith "192.168." or RemoteIP startswith "172."
    | summarize InternalTargets = dcount(RemoteIP), Ports = make_set(RemotePort) by DeviceName
    | where InternalTargets > 15
) on DeviceName
| join kind=leftouter (
    DeviceFileEvents
    | where Timestamp > ago(staging_window)
    | where FileName endswith ".vss" or FolderPath has "Volume Shadow Copy"
       or (InitiatingProcessCommandLine has_any ("vssadmin", "bcdedit", "wbadmin"))
    | summarize ShadowTamperEvents = count(), TamperCmds = make_set(InitiatingProcessCommandLine) by DeviceName
) on DeviceName
| project DeviceName, AccountName, FirstSeen, Toolset, InternalTargets, Ports, ShadowTamperEvents, TamperCmds, CmdLines
| order by ShadowTamperEvents desc, InternalTargets desc;

Rapid-Response PowerShell — Exposure & Persistence Triage

Run this on suspect hosts (or domain-wide via your EDR/remote shell) to enumerate the artifacts DIREWOLF affiliates leave behind in the pre-detonation window.

# DIREWOLF Rapid Triage: new services, scheduled tasks, shadow copies, RDP exposure
# Run elevated. Output: console + C:\IR\direwolf_triage_<hostname>_<date>.txt
$out = "C:\IR\direwolf_triage_$($env:COMPUTERNAME)_$(Get-Date -Format yyyyMMdd_HHmm).txt"
New-Item -Path 'C:\IR' -ItemType Directory -Force | Out-Null
Start-Transcript -Path $out -Force

Write-Host '=== [1] Scheduled tasks created/modified in last 7 days ==='
Get-ScheduledTask | ForEach-Object {
    $info = $_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue
    [PSCustomObject]@{ TaskName=$_.TaskName; Path=$_.TaskPath; Author=$_.Author; LastRun=$info.LastRunTime }
} | Where-Object { $_.Author -notmatch 'Microsoft' } | Format-Table -AutoSize

Write-Host '=== [2] Services installed in last 7 days (Event 7045) ==='
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
    Select-Object TimeCreated, @{n='Service';e={$_.Properties[0].Value}}, @{n='Binary';e={$_.Properties[1].Value}} | Format-List

Write-Host '=== [3] Volume Shadow Copy status (deletion = pre-encryption indicator) ==='
vssadmin list shadows
Get-WmiObject Win32_ShadowCopy -ErrorAction SilentlyContinue | Select-Object ID, InstallDate, VolumeName | Format-Table -AutoSize

Write-Host '=== [4] RDP exposure check ==='
$rdp = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue
Write-Host ("RDP Enabled: " + $(if ($rdp.fDenyTSConnections -eq 0) {'YES - VERIFY BUSINESS NEED'} else {'No'}))
Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue | Format-Table LocalAddress, LocalPort, OwningProcess

Write-Host '=== [5] Suspicious outbound connections to cloud/exfil endpoints ==='
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
    Where-Object { $_.RemotePort -in 443,21,22 } |
    ForEach-Object { $p = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
        [PSCustomObject]@{ Process=$p.ProcessName; Path=$p.Path; RemoteIP=$_.RemoteAddress; Port=$_.RemotePort } } |
    Where-Object { $_.Path -notmatch 'Program Files|Windows' } | Sort-Object RemoteIP -Unique | Format-Table -AutoSize

Write-Host '=== [6] New local admin accounts in last 14 days ==='
Get-LocalGroupMember -Group 'Administrators' -ErrorAction SilentlyContinue | Format-Table Name, ObjectClass, PrincipalSource

Stop-Transcript
Write-Host "Triage output written to $out"

Incident Response Priorities — DIREWOLF Playbook

T-Minus Detection Checklist (Before Encryption Fires)

DIREWOLF's 48–72 hour staging window is your interception opportunity. Hunt for, in order:

1. New service installations (Event 7045) referencing ADMIN$ or randomized service names
2. Archive tooling execution (rclone/7z/RAR) from non-IT service accounts, especially on file servers and database hosts
3. vssadmin/bcdedit/wbadmin execution — shadow copy deletion is the final pre-detonation step
4. WmiPrvSE.exe spawning cmd/powershell across multiple hosts in a short window
5. Credential dumping artifacts — lsass.exe memory access by non-system processes, NTDS.dit access
6. Mass SMB write activity from a single host (encryptor staging) — often the last telemetry before detonation

Exfiltration Priorities (What They Steal First)

• Finance and legal data (contracts, M&A documents, payroll)
• Customer databases and PII (leverage for regulatory-pressure extortion)
• Intellectual property — source code and engineering documents (note the technology-sector targeting in this wave)
• Email archives of executive leadership
• For energy/utility victims: operational documentation, network diagrams, OT-adjacent schematics

Containment Actions — Ordered by Urgency

1. Isolate, don't power off suspected staging hosts (preserve memory for forensics; cutting power destroys evidence of the exfil destination)
2. Block egress to consumer cloud storage (MEGA, Dropbox, anonymous file-sharing) at the proxy/firewall immediately
3. Disable compromised accounts and force enterprise-wide credential resets, prioritizing Domain Admins and service accounts
4. Patch or isolate Check Point gateways and ScreenConnect instances — if unpatched, assume the foothold persists elsewhere
5. Segment backup infrastructure and verify offline/immutable backup integrity before initiating recovery planning
6. Engage IR retainer and legal counsel early — DIREWOLF's leak cadence means public disclosure risk escalates within days of the teaser post

Hardening Recommendations

Immediate (24 Hours)

• Patch Check Point Security Gateway (CVE-2026-50751) — or disable IKEv1 where operationally feasible. This is the highest-probability entry vector in the current wave
• Patch/audit ConnectWise ScreenConnect (CVE-2024-1708) and all RMM tooling; alert on any RMM binary not on your approved-software list
• Block outbound traffic to rclone-supported anonymous storage endpoints; alert on rclone.exe execution anywhere outside IT backup workflows
• Enforce phishing-resistant MFA (FIDO2) on all remote access — VPN, RDP gateways, and admin consoles
• Deploy the Sigma rules and KQL query above to your SIEM/EDR and validate with test telemetry
• Verify Volume Shadow Copies exist on critical file servers and that vssadmin execution is alerted domain-wide

Short-Term (2 Weeks)

• Eliminate direct internet exposure of RDP and Exchange; place all remote access behind ZTNA/VPN with device posture checks
• Implement application control (WDAC/AppLocker) blocking unsigned archive and sync tooling on servers and workstations
• Deploy canary file shares and decoy credentials to detect pre-encryption reconnaissance and data staging
• Segment backup networks with one-way replication to immutable storage; test a full restore of one critical system
• Enable tamper protection and block-mode EDR on all endpoints; ensure EDR coverage on domain controllers and backup servers specifically
• Review service account hygiene — DIREWOLF affiliates weaponize over-privileged service accounts for rapid domain-wide deployment

This briefing is based on dark web leak site monitoring conducted 2026-09-05. Victim postings represent claims by the threat actor; inclusion does not confirm the scope of any individual compromise. Organizations named in this report should refer to their own incident response processes and regulatory obligations.

Related Resources

Security Arsenal Incident Response

Managed SOC & MDR Services

AlertMonitor Threat Detection

From The Dark Side Intel Hub