DIREWOLF Ransomware Gang: 13 Victims Posted in Single-Day Leak Site Surge — Sector Analysis & Detection Rules

DIREWOLF is a ransomware operation first observed in the criminal underground ecosystem and tracked continuously on leak-site telemetry via ransomware.live. Based on observed posting cadence, victimology, and negotiation artifacts, our current assessment:

• Aliases / overlaps: No confirmed rebrands. Tracking under the singular DIREWOLF name. Infrastructure and leak-site tradecraft show moderate overlap with mid-tier post-Conti-era crews, but no definitive attribution linkage has been established.
• Operating model: Assessed as a closed or tightly vetted RaaS — victim volume is steady rather than mass-scale, suggesting a small affiliate pool rather than an open recruitment model.
• Ransom demands: Observed demands cluster in the $250K–$2.5M USD range, scaled to victim revenue. Mid-market manufacturing and education victims trend toward the lower bound; financial services victims toward the upper bound.
• Initial access methods (observed across underground chatter and incident telemetry):
  • Exploitation of internet-facing VPN / security gateway appliances (consistent with the Check Point CVE-2026-50751 exploitation wave in the CISA KEV)
  • RDP exposure and brute force against unmanaged or legacy endpoints
  • Phishing with macro-enabled lures, frequently themed as invoices, shipping documents, or HR notices
  • Opportunistic use of compromised remote monitoring & management (RMM) tooling — the ScreenConnect CVE-2024-1708 exploitation chain remains a recurring access vector across ransomware crews of this tier
  • Supply-chain/developer-tool compromise is a growing secondary vector (see Nx Console CVE-2026-48027 in KEV)
• Extortion model: Double extortion — data exfiltration precedes encryption; leak-site publication is used as the pressure lever. All 13 victims in this batch were posted to the leak site, indicating either refused negotiations or expired deadlines.
• Dwell time: Estimated 5–14 days from initial access to detonation in observed intrusions, with exfiltration typically occurring in the final 48–72 hours before encryption.

Current Campaign Analysis

Sector Targeting (this posting batch)

Key observations:

1. SaaS and cloud-software firms are overrepresented. Reviso Cloud Accounting, Aztec Software, Authenticate Information Systems, and Studee are all software/SaaS providers. This is consistent with a deliberate strategy of hitting firms whose compromise creates downstream pressure — their customers force them to pay, and their environments hold third-party data that raises extortion leverage.
2. Education remains a soft target. A US school district (Deer Creek-Mackinaw CUSD) aligns with the broader 2026 trend of ransomware crews exploiting under-resourced K-12 security postures, typically via exposed RMM or unpatched edge devices.
3. Aviation-adjacent targeting: ProSim Aviation Research suggests interest in specialized engineering/IP-rich victims, not just opportunistic volume.

Geographic Concentration

US leads with 6 of 13 victims, followed by Mexico (2), with single victims in Denmark, UAE, Netherlands, and Canada. This is a broad Western + Gulf footprint — not regionally constrained — consistent with opportunistic edge-device exploitation rather than a targeted regional campaign.

Victim Profile

The victim set skews small-to-mid-market (roughly 50–1,500 employees, estimated $5M–$300M revenue) — the classic DIREWOLF band. No Fortune 500-scale victims in this batch. These organizations typically lack 24/7 SOC coverage, which matches the gang's observed preference for weekend/holiday detonation windows.

Posting Frequency / Escalation

A 13-victim single-day drop is a mass-publication event, not a steady drip. This pattern indicates one of two things: (a) a batch of negotiations expired simultaneously, or (b) a deliberate "shock" publication to build brand pressure and improve conversion on current negotiations. Either way, expect follow-on postings from this same access wave within 7–14 days.

CVE Correlation — Probable Initial Access Vectors

The CISA KEV entries below are confirmed ransomware-exploited and map directly to DIREWOLF's known access profile:

• CVE-2026-50751 (Check Point Security Gateway, improper authentication in IKEv1) — Added to KEV 2026-06-08. This is the highest-priority correlation: perimeter VPN gateway compromise is DIREWOLF's primary suspected vector in this campaign. Any unpatched Check Point gateway is an active liability.
• CVE-2024-1708 (ConnectWise ScreenConnect path traversal → RCE) — RMM abuse for hands-on-keyboard access and persistence.
• CVE-2025-60710 (Windows link following → privilege escalation) — Post-access privilege escalation on endpoints.
• CVE-2023-21529 (Exchange deserialization) — Authenticated RCE on on-prem Exchange; relevant for victims with legacy mail infrastructure.
• CVE-2026-48027 (Nx Console embedded malicious code) — Developer-workstation supply-chain vector; relevant given this batch's software-company victimology.

Assessment: This campaign is most consistent with perimeter appliance exploitation (CVE-2026-50751) followed by internal privilege escalation (CVE-2025-60710) and staging via RMM tooling.

Detection Engineering

The following Sigma rules target DIREWOLF's observed TTPs: VPN/perimeter exploitation follow-on behavior, RMM-based lateral movement, and pre-encryption staging (shadow copy deletion, mass file access).

---
title: Suspicious Process Spawned by VPN or Security Gateway Service Context
description: Detects shells or scripting engines spawned shortly after authentication anomalies on perimeter VPN/security gateway services — consistent with post-exploitation of appliances such as Check Point Security Gateway (CVE-2026-50751) used by DIREWOLF for initial access.
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\svchost.exe'
      - '\services.exe'
      - '\lsass.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\rundll32.exe'
      - '\mshta.exe'
  filter_known_good:
    CommandLine|contains:
      - 'conhost'
  condition: selection_parent and selection_child and not filter_known_good
falsepositives:
  - Legitimate management agents; tune against known RMM/EDR parent-child baselines
level: high
tags:
  - attack.initial_access
  - attack.t1190
  - attack.t1059
---
title: Unauthorized RMM Tool Execution — ScreenConnect and Common Abuse Set
description: Detects execution of remote monitoring and management tools frequently abused by ransomware affiliates (DIREWOLF included) for hands-on-keyboard access and lateral movement, including tooling dropped via CVE-2024-1708 exploitation.
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\ScreenConnect.ClientService.exe'
      - '\ScreenConnect.WindowsClient.exe'
      - '\anydesk.exe'
      - '\TeamViewer.exe'
      - '\AteraAgent.exe'
      - '\SplashtopSOS.exe'
      - '\rustdesk.exe'
      - '\ninjarmmcli.exe'
  filter_approved_paths:
    Image|startswith:
      - 'C:\Program Files\ScreenConnect'
      - 'C:\Program Files\TeamViewer'
  condition: selection_img and not filter_approved_paths
falsepositives:
  - Approved IT remote support tooling — maintain an explicit allowlist of sanctioned RMM paths and hashes
level: high
tags:
  - attack.command_and_control
  - attack.t1219
  - attack.lateral_movement
---
title: Pre-Encryption Staging — Shadow Copy Deletion and Mass File Rename
description: Detects classic pre-detonation behavior observed across DIREWOLF intrusions — Volume Shadow Copy deletion via vssadmin/wmic/bcdedit combined with suspicious mass file modification, indicating ransomware staging in the final hours before encryption.
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    - Image|endswith: '\vssadmin.exe'
      CommandLine|contains:
        - 'delete shadows'
        - 'resize shadowstorage'
    - Image|endswith: '\wmic.exe'
      CommandLine|contains: 'shadowcopy delete'
    - Image|endswith: '\bcdedit.exe'
      CommandLine|contains:
        - 'recoveryenabled no'
        - 'ignoreallfailures'
    - Image|endswith: '\wbadmin.exe'
      CommandLine|contains: 'delete catalog'
  selection_privesc_context:
    IntegrityLevel:
      - 'System'
      - 'High'
  condition: selection_vss and selection_privesc_context
falsepositives:
  - Rare; legitimate backup administration — correlate with change windows and service accounts
level: critical
date: 2026/08/21
tags:
  - attack.impact
  - attack.t1490
  - attack.defense_evasion

Hunt query for Microsoft Sentinel — correlates RMM execution, new local admin creation, and suspicious outbound transfer volume on the same host within a 72-hour window (DIREWOLF's typical exfil-before-encryption window):

// DIREWOLF pre-ransomware staging hunt — RMM abuse + privilege escalation + exfil staging
// Lookback: 7 days | Correlation window: 72 hours per device
let lookback = 7d;
let rmmNames = dynamic(["ScreenConnect.ClientService.exe","anydesk.exe","TeamViewer.exe","AteraAgent.exe","rustdesk.exe","SplashtopSOS.exe","ninjarmmcli.exe"]); 
let rmmExec =
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where FileName in~ (rmmNames)
    | summarize RMMFirstSeen=min(TimeGenerated), RMMCount=count(), RMMUsers=make_set(InitiatingProcessAccountName) by DeviceId, DeviceName;
let adminAdds =
    SecurityEvent
    | where TimeGenerated > ago(lookback)
    | where EventID in (4728, 4732, 4756)  // added to privileged groups
    | where TargetUserName !endswith "$"
    | summarize AdminAdds=count(), AddedAccounts=make_set(TargetUserName) by Computer;
let shadowDelete =
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where (FileName =~ "vssadmin.exe" and ProcessCommandLine has "delete shadows")
        or (FileName =~ "bcdedit.exe" and ProcessCommandLine has "recoveryenabled")
        or (FileName =~ "wbadmin.exe" and ProcessCommandLine has "delete catalog")
    | summarize ShadowDeleteEvents=count(), LastShadowCmd=arg_max(TimeGenerated, ProcessCommandLine) by DeviceId, DeviceName;
let outboundSpike =
    DeviceNetworkEvents
    | where TimeGenerated > ago(lookback)
    | where RemoteIPType == "Public"
    | summarize TotalConns=count(), UniqueDestinations=dcount(RemoteIP), TopDests=make_set(RemoteUrl, 10) by DeviceId;
rmmExec
| join kind=inner (outboundSpike) on DeviceId
| join kind=leftouter (adminAdds) on $left.DeviceName == $right.Computer
| join kind=leftouter (shadowDelete) on DeviceId
| where TotalConns > 5000 or ShadowDeleteEvents > 0
| project DeviceName, RMMFirstSeen, RMMCount, RMMUsers, TotalConns, UniqueDestinations, AddedAccounts, ShadowDeleteEvents, LastShadowCmd
| sort by ShadowDeleteEvents desc, TotalConns desc

Rapid-response PowerShell script — run on suspect hosts or fleet-wide via your RMM/EDR to surface DIREWOLF pre-detonation indicators: recently created scheduled tasks, shadow copy tampering, exposed RDP, and new local admins in the last 7 days:

# DIREWOLF Rapid Triage — pre-encryption indicator sweep
# Run elevated. Outputs consolidated findings to C:\IR\direwolf-triage-<host>.txt
$out = "C:\IR"; New-Item -ItemType Directory -Path $out -Force | Out-Null
$report = "$out\direwolf-triage-$env:COMPUTERNAME.txt"
$cutoff = (Get-Date).AddDays(-7)
"=== DIREWOLF Rapid Triage :: $env:COMPUTERNAME :: $(Get-Date -Format o) ===" | Out-File $report

"`n[1] Scheduled tasks created/modified in last 7 days (persistence check)" | Out-File $report -Append
Get-ScheduledTask | Where-Object { $_.Date -and ([datetime]$_.Date) -gt $cutoff } |
  Select-Object TaskName, TaskPath, Date, @{N='Action';E={$_.Actions.Execute}} |
  Format-Table -AutoSize | Out-String | Out-File $report -Append

"`n[2] Volume Shadow Copy status (T1490 check)" | Out-File $report -Append
$vss = Get-WmiObject Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $vss) { "WARNING: NO shadow copies present — possible vssadmin deletion" | Out-File $report -Append }
else { $vss | Select-Object InstallDate, DeviceObject, VolumeName | Format-Table -AutoSize | Out-String | Out-File $report -Append }
vssadmin list shadows 2>&1 | Out-File $report -Append

"`n[3] RDP exposure check" | Out-File $report -Append
$rdp = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue
"RDP Enabled: $(if ($rdp.fDenyTSConnections -eq 0) {'YES — INVESTIGATE'} else {'No'})" | Out-File $report -Append
Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue |
  Select-Object LocalAddress, LocalPort, State | Format-Table -AutoSize | Out-String | Out-File $report -Append

"`n[4] New local administrators (last 7 days of security log)" | Out-File $report -Append
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4732,4728,4756; StartTime=$cutoff} -ErrorAction SilentlyContinue |
  Select-Object TimeCreated, Id, @{N='Detail';E={$_.Message.Substring(0,[Math]::Min(300,$_.Message.Length))}} |
  Format-List | Out-String | Out-File $report -Append

"`n[5] Unauthorized RMM processes / binaries" | Out-File $report -Append
$rmm = 'ScreenConnect','anydesk','TeamViewer','Atera','rustdesk','Splashtop','ninjarmm'
Get-Process | Where-Object { $n=$_.ProcessName; $rmm | Where-Object { $n -match $_ } } |
  Select-Object ProcessName, Id, Path | Format-Table -AutoSize | Out-String | Out-File $report -Append
Get-ChildItem 'C:\Users\*\Downloads','C:\ProgramData' -Recurse -Include *.exe -ErrorAction SilentlyContinue -Depth 2 |
  Where-Object { $_.CreationTime -gt $cutoff -and ($rmm | Where-Object { $_.Name -match $_ }) } |
  Select-Object FullName, CreationTime | Format-Table -AutoSize | Out-String | Out-File $report -Append

"`n[6] Suspicious recent logons — network logons (Type 3/10) from non-standard sources" | Out-File $report -Append
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=$cutoff} -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match 'Logon Type:\s+(3|10)' -and $_.Message -notmatch 'ANONYMOUS' } |
  Group-Object { ($_.Message -split "`n") -match 'Account Name' | Select-Object -First 1 } |
  Sort-Object Count -Descending | Select-Object -First 15 Name, Count |
  Format-Table -AutoSize | Out-String | Out-File $report -Append

"`nTriage complete: $report" | Out-File $report -Append
Write-Host "Report written to $report" -ForegroundColor Cyan

Incident Response Priorities

T-Minus Detection Checklist — Before Encryption Fires

DIREWOLF's dwell window is 5–14 days, with the loudest telemetry in the final 72 hours. Hunt for, in priority order:

1. Shadow copy / backup tampering — vssadmin delete shadows, bcdedit recoveryenabled no, wbadmin delete catalog (CRITICAL — typically T-minus hours)
2. Mass file access bursts by a single account across multiple hosts (staging behavior)
3. Unauthorized RMM binaries (ScreenConnect, AnyDesk, Atera, RustDesk) outside approved paths
4. New local admin accounts or unexpected group membership changes (Event IDs 4728/4732/4756)
5. Outbound transfer spikes to cloud storage or unfamiliar public IPs (exfil window)
6. Check Point gateway authentication anomalies — IKEv1 negotiation failures followed by successful admin-context logins (CVE-2026-50751 exploitation residue)
7. Disabled EDR/AV services or tamper events on endpoints
8. PsExec/WMI remote service creation (Event ID 7045) for lateral movement

Exfiltration Priorities This Gang Historically Targets

Based on leak-site contents and sector victimology:

• Financial records — accounting databases, payroll, banking details (note this batch's accounting-software victim)
• PII of students/employees/customers — education and hospitality victims yield high-volume PII for extortion leverage
• Intellectual property / source code — aviation research and software firms in this batch suggest deliberate IP theft
• Legal/contracts and insurance policies — used to calibrate ransom demands against coverage limits

Containment Actions — Ordered by Urgency

1. Isolate suspected staging hosts from the network immediately (EDR network isolation, not shutdown — preserve memory)
2. Disable compromised accounts and force enterprise-wide credential reset, prioritizing VPN, admin, and service accounts
3. Block unauthorized RMM execution fleet-wide via AppLocker/WDAC or EDR policy
4. Sever the perimeter vector — take the exploited VPN gateway offline or into maintenance mode; rotate all gateway certificates and pre-shared keys
5. Protect backups — verify offline/immutable backup integrity before touching anything else; assume online backup agents are targeted
6. Snapshot forensic evidence — memory capture and triage collection on affected hosts before remediation wipes IOCs
7. Engage IR retainer and legal/comms — leak-site publication means the data is already out; notification obligations are likely triggered

Hardening Recommendations

Immediate (24 hours)

• Patch Check Point Security Gateways against CVE-2026-50751 — this is the presumed front door for this campaign. If patching is not immediately possible, restrict gateway management interfaces to allowlisted IPs and disable IKEv1 where feasible.
• Patch ConnectWise ScreenConnect (CVE-2024-1708) and audit for rogue instances — enumerate all RMM tools on the network and kill anything not on the approved list.
• Block RDP from the internet entirely; place behind VPN + MFA. Audit for 3389 listeners on non-standard hosts.
• Enforce phishing-resistant MFA on all remote access — VPN, RMM consoles, email.
• Deploy the Sigma rules above and run the Sentinel hunt query against the last 14 days of data.
• Verify backup immutability and test one restore today.

Short-term (2 weeks)

• Application control (WDAC/AppLocker) with an explicit RMM allowlist — deny-by-default for remote access tooling.
• Network segmentation isolating backup infrastructure, domain controllers, and education/OT-adjacent VLANs from general user segments.
• Exchange Server hardening — patch CVE-2023-21529, restrict EWS/OWA exposure, and enable extended protection for authentication.
• Windows LPE patching cadence — CVE-2025-60710 and similar link-following bugs are standard post-access escalation; move edge and workstation patching to an expedited ring for KEV-listed CVEs.
• Developer toolchain governance — given the Nx Console supply-chain CVE and this batch's software-company victimology, pin and verify IDE extension/CLI versions and monitor for anomalous build-agent outbound traffic.
• Deception layer — canary credentials and honeypot file shares on file servers; DIREWOLF's staging behavior trips these reliably in the dwell window.
• 24/7 monitoring coverage — every victim in this batch fits the "no overnight SOC" profile. If in-house coverage isn't feasible, managed detection is the single highest-leverage architectural change available.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub