DIREWOLF Ransomware Gang: 3 Healthcare & Tech Victims Posted in 24 Hours — Sector Targeting Analysis & Detection Rules

Classification: TLP:CLEAR | Publication Date: 2026-08-31 | Source: ransomware.live dark web leak site monitoring

Executive Summary

Security Arsenal's dark web monitoring infrastructure has confirmed that the DIREWOLF ransomware operation posted three new victims to its .onion leak site within a single 24-hour window (2026-08-30): Hospital Clínico Universidad de Chile (Healthcare, Chile), Erdem Hospital (Healthcare, Türkiye), and THQ Nordic (Technology, Sweden). Two of the three victims are hospital systems — a deliberate concentration on healthcare infrastructure that mirrors the gang's historical willingness to target life-critical services for maximum extortion leverage. This briefing provides enterprise security teams with actor profiling, campaign analysis, and deployable detection engineering content.

Threat Actor Profile — DIREWOLF

DIREWOLF's tradecraft emphasizes living-off-the-land techniques post-compromise, making behavioral detection (rather than signature-based) the primary defensive layer.

Current Campaign Analysis

Sector Targeting

• Healthcare (2/3 victims): Hospital Clínico Universidad de Chile (CL) and Erdem Hospital (TR). DIREWOLF's healthcare focus is calculated — hospitals face extreme operational pressure, hold high-value PII/PHI, and historically show elevated payment propensity under patient-safety duress.
• Technology (1/3 victims): THQ Nordic (SE), a mid-market game publisher. Technology victims are typically extorted over unreleased IP and source code.

Geographic Concentration

The campaign spans Chile, Türkiye, and Sweden — no single geographic concentration, indicating opportunistic access-driven targeting rather than region-specific operations. Latin America and Türkiye are consistent with the gang's pattern of hitting organizations with comparatively weaker perimeter patch cadence.

Victim Profile

• Hospital Clínico Universidad de Chile: Large academic hospital system; est. revenue $200M–$500M; high PHI volume.
• Erdem Hospital: Private hospital group, Türkiye; est. revenue $100M–$300M.
• THQ Nordic: Publicly listed mid-cap technology/entertainment firm; est. revenue $300M+.

Posting Frequency / Escalation

All three postings landed on 2026-08-30, suggesting a coordinated leak-site publishing burst — consistent with victims who refused or stalled negotiations hitting their countdown deadlines simultaneously. A 3-victims-in-one-day cadence represents an escalation signal and typically precedes a new intrusion wave 2–4 weeks later.

Initial Access Correlation — CISA KEV

The following actively exploited CVEs align with DIREWOLF's known access tradecraft and should be treated as priority patch items:

• CVE-2026-50751 — Check Point Security Gateway improper authentication (IKEv1 key exchange). Direct match to DIREWOLF's perimeter VPN exploitation vector. Patch immediately if running Check Point gateways.
• CVE-2024-1708 — ConnectWise ScreenConnect path traversal → RCE. Consistent with the gang's abuse of RMM tooling for both access and persistence.
• CVE-2025-60710 — Windows link-following privilege escalation (post-compromise elevation).
• CVE-2023-21529 — Exchange Server deserialization (authenticated RCE; lateral entry point).
• CVE-2026-48027 — Nx Console embedded malicious code — a supply-chain vector relevant to the technology-sector intrusion.

Detection Engineering

Sigma Rules

---
title: DIREWOLF - Suspicious Authentication Against VPN/Security Gateway
description: Detects anomalous authentication patterns against perimeter VPN/security gateways consistent with DIREWOLF initial access via CVE-2026-50751 and credential attacks
status: experimental
date: 2026/08/31
author: Security Arsenal Threat Intel
logsource:
  category: authentication
  product: vpn
detection:
  selection_fail:
    outcome: failure
  filter_geo:
    source_country|contains:
      - 'RU'
      - 'CN'
      - 'IR'
      - 'KP'
  timeframe: 10m
  condition: selection_fail and not filter_geo | count(source_ip) by user > 5
level: high
tags:
  - attack.initial_access
  - attack.t1190
  - attack.t1110
---
title: DIREWOLF - Office Macro Spawning Scripting or LOLBin Child Process
description: Detects Office applications spawning script interpreters or LOLBins, consistent with DIREWOLF phishing macro execution leading to Cobalt Strike staging
status: experimental
date: 2026/08/31
author: Security Arsenal Threat Intel
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\outlook.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
level: high
tags:
  - attack.execution
  - attack.t1059
  - attack.t1204.002
---
title: DIREWOLF - Pre-Encryption Staging - Rclone or Archive Exfiltration Followed by Shadow Copy Deletion
description: Detects data staging tooling (Rclone/7z/WinSCP) and Volume Shadow Copy deletion indicative of DIREWOLF pre-detonation behavior
status: experimental
date: 2026/08/31
author: Security Arsenal Threat Intel
logsource:
  category: process_creation
  product: windows
detection:
  selection_staging:
    Image|endswith:
      - '\rclone.exe'
      - '\winscp.exe'
      - '\7z.exe'
      - '\rar.exe'
    CommandLine|contains:
      - 'copy'
      - 'sync'
      - 'mega.nz'
      - 'mega.io'
  selection_vss:
    CommandLine|contains:
      - 'vssadmin delete shadows'
      - 'vssadmin Delete Shadows'
      - 'wmic shadowcopy delete'
      - 'bcdedit /set'
      - 'wbadmin delete catalog'
  condition: selection_staging or selection_vss
level: critical
tags:
  - attack.exfiltration
  - attack.t1567.002
  - attack.impact
  - attack.t1490

KQL Hunt — Microsoft Sentinel (Lateral Movement & Pre-Ransomware Staging)

// DIREWOLF Hunt: PsExec/WMI lateral movement + pre-encryption staging indicators
// Lookback: 14 days
let lookback = 14d;
let stagingProcs = dynamic(["rclone.exe","winscp.exe","7z.exe","rar.exe","psexec.exe","psexesvc.exe"]);
let vssCommands = dynamic(["vssadmin delete shadows","wmic shadowcopy delete","wbadmin delete catalog","bcdedit"]);
union
(DeviceProcessEvents
 | where TimeGenerated > ago(lookback)
 | where FileName in~ (stagingProcs)
 | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, Indicator="Staging/Lateral Tool"),
(DeviceProcessEvents
 | where TimeGenerated > ago(lookback)
 | where ProcessCommandLine has_any (vssCommands)
 | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, Indicator="Shadow Copy Tampering"),
(DeviceNetworkEvents
 | where TimeGenerated > ago(lookback)
 | where RemotePort in (445, 135, 5985, 5986)
 | summarize ConnCount=count(), Targets=dcount(RemoteIP) by DeviceName, InitiatingProcessFileName, bin(TimeGenerated, 1h)
 | where Targets > 15
 | project TimeGenerated, DeviceName, InitiatingProcessFileName, ConnCount, Targets, Indicator="SMB/WMI/WinRM Fan-out"))
| sort by TimeGenerated desc

Rapid-Response PowerShell Script

# DIREWOLF Rapid Triage: enumerate 7-day scheduled tasks, shadow copies, and exposed RDP
# Run elevated on suspect hosts or via your EDR remote shell
$cutoff = (Get-Date).AddDays(-7)

Write-Host "=== [1] Scheduled Tasks Created/Modified in Last 7 Days ===" -ForegroundColor Cyan
Get-ScheduledTask | ForEach-Object {
    $info = $_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue
    $taskPath = "$($_.TaskPath)$($_.TaskName)"
    try {
        $xml = [xml](Export-ScheduledTask -TaskName $_.TaskName -TaskPath $_.TaskPath -ErrorAction Stop)
        $regDate = [datetime]$xml.Task.RegistrationInfo.Date
        if ($regDate -gt $cutoff) {
            [PSCustomObject]@{ Task = $taskPath; Registered = $regDate; Author = $xml.Task.RegistrationInfo.Author; Action = ($xml.Task.Actions.Exec.Command -join '; ') }
        }
    } catch {}
} | Format-Table -AutoSize

Write-Host "=== [2] Volume Shadow Copies (absence = pre-encryption indicator) ===" -ForegroundColor Cyan
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows) { Write-Host "WARNING: No shadow copies present - possible vssadmin deletion" -ForegroundColor Red }
else { $shadows | Select-Object ID, InstallDate, VolumeName | Format-Table -AutoSize }

Write-Host "=== [3] Recent vssadmin/wmic shadow deletion events (Event ID 4680/7045 context) ===" -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=$cutoff} -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match 'vssadmin|shadowcopy|wbadmin|bcdedit' } |
  Select-Object TimeCreated, Message -First 25 | Format-List

Write-Host "=== [4] RDP Exposure Check ===" -ForegroundColor Cyan
$rdp = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue
$rdpEnabled = ($rdp.fDenyTSConnections -eq 0)
Write-Host "RDP Enabled: $rdpEnabled"
Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue | Select-Object LocalAddress, LocalPort, OwningProcess
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=$cutoff} -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match 'Logon Type:\s+(3|10)' } |
  Group-Object { ([regex]::Match($_.Message,'Source Network Address:\s+(\S+)')).Groups[1].Value } |
  Where-Object { $_.Count -gt 20 } | Sort-Object Count -Descending |
  Select-Object Count, Name | Format-Table -AutoSize

Incident Response Priorities

T-Minus Detection Checklist (Before Encryption Fires)

• Rclone/WinSCP/7-Zip execution on servers holding sensitive data (staging typically 48–96h pre-detonation)
• Outbound transfers >5GB to uncommon cloud storage or foreign IPs
• vssadmin delete shadows, bcdedit, or wbadmin delete catalog execution
• New local/domain admin accounts or unexpected group membership changes
• PsExec service creation (Event 7045) or SMB/WinRM fan-out from a single workstation
• GPO modifications deploying suspicious scripts or binaries
• Cobalt Strike Malleable C2 callbacks (JA3/JA3S anomalies on TLS egress)

Critical Assets This Gang Prioritizes for Exfiltration

• Patient records / PHI databases (healthcare victims — highest extortion leverage)
• Financial records, payroll, and HR PII
• Source code repositories, build servers, and unreleased IP (technology victims)
• Domain controller NTDS.dit and backup catalogs
• Legal/contracts and executive mailbox archives

Containment Actions — Ordered by Urgency

1. Isolate affected segments at the network layer (disable switch ports / NAC quarantine) — do not power off hosts (preserves memory evidence).
2. Disable compromised accounts and force enterprise-wide credential resets, prioritizing tier-0/admin accounts; revoke active sessions and tokens.
3. Block exfiltration egress — deny outbound to known staging destinations; sinkhole C2 domains/IPs at the resolver and proxy.
4. Disable PsExec/WinRM/RDP laterally via emergency GPO; restrict SMB to required servers only.
5. Protect backups — take backup infrastructure offline from the production domain; verify offline/immutable copies before restore planning.
6. Preserve forensics — capture memory and triage images of patient-zero host before remediation.
7. Engage IR retainer and legal/comms counsel; assess PHI/PII regulatory notification obligations (especially for the healthcare victims' peer organizations).

Hardening Recommendations

Immediate (24 Hours)

• Patch Check Point Security Gateway (CVE-2026-50751) and ConnectWise ScreenConnect (CVE-2024-1708) — these map directly to DIREWOLF's observed initial access vectors.
• Audit and disable internet-exposed RDP; enforce VPN+MFA for all remote administration; block RDP at the perimeter.
• Deploy/verify the Sigma rules and KQL hunt above across your SIEM/EDR stack.
• Block or alert on execution of rclone.exe, psexec.exe, and unsigned archive utilities on servers.
• Enable macro-blocking policy for Office files originating from the internet (Mark of the Web enforcement).
• Verify Volume Shadow Copy and backup integrity; alert on any shadow deletion event.

Short-Term (2 Weeks)

• Segment clinical/OT-adjacent networks (healthcare) and build/release infrastructure (technology) away from general corporate AD trusts.
• Implement tiered administration with dedicated Privileged Access Workstations; eliminate standing domain admin usage.
• Deploy egress data-loss detection with TLS inspection or JA3 fingerprinting to catch staged exfiltration.
• Move backups to immutable/offline storage with isolated credentials outside the production domain.
• Roll out phishing-resistant MFA (FIDO2) for all remote access and administrative interfaces.
• Establish dark web leak-site monitoring for your organization's name, domains, and executive identities to catch pre-publication extortion signals.

Security Arsenal continues to monitor DIREWOLF's leak site and infrastructure. Organizations in healthcare and technology — particularly in CL, TR, and SE — should treat this campaign as an active threat and validate their exposure to the KEV-listed CVEs immediately.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub