DIREWOLF Ransomware Gang: 6 Victims Posted in 48 Hours — Healthcare & Tech Targeting Analysis with Detection Rules

Classification: TLP:AMBER | Source: ransomware.live dark web leak site monitoring | Report Date: 2026-08-16

Security Arsenal's dark web collection infrastructure has confirmed a concentrated victim-posting burst from the DIREWOLF ransomware operation. Between 2026-08-15 and 2026-08-16, six organizations were listed on the group's .onion leak site simultaneously — a pattern consistent with a batch-detonation campaign rather than opportunistic intrusion. Organizations in healthcare, technology, financial services, and professional services in GB, US, BR, and IN should treat this as an active-threat window.

Threat Actor Profile — DIREWOLF

DIREWOLF's tradecraft emphasizes living-off-the-land lateral movement (WMI, PsExec-style service creation) and aggressive destruction of Volume Shadow Copies immediately before encryption — consistent with groups that prioritize exfiltration leverage over pure encryption speed.

Current Campaign Analysis

Victims Posted (2026-08-15)

• DXS International — Technology, GB
• PayrHealth — Healthcare, US
• Colla Health — Healthcare, US
• TOTVS — Technology, BR
• AAM:HOA Management — Professional Services, US
• DodoPayments — Financial Services, IN

Sector Targeting

Healthcare represents 33% of this burst (2/6), with technology at 33%. The healthcare focus is notable: these organizations hold PHI with high extortion leverage and face regulatory breach-notification clocks that shorten negotiation windows — a deliberate pressure mechanism. The technology targets (DXS International, TOTVS) raise downstream supply-chain concern — TOTVS in particular is a major ERP vendor in Brazil, and compromise of a software vendor warrants scrutiny for potential downstream customer exposure.

Geographic Concentration

US (3), GB (1), BR (1), IN (1). The multi-continent spread within a single posting window indicates parallel intrusions, likely run by different affiliates under the same RaaS umbrella, rather than a single intrusion team moving sequentially.

Victim Profile

Mix of mid-market and enterprise organizations. Revenue estimates range from ~$25M (regional healthcare services) to $1B+ (TOTVS). DIREWOLF appears to optimize for organizations large enough to pay six-to-seven figures but without mature 24/7 SOC coverage.

Posting Frequency & Escalation

A 6-victim single-day burst represents a significant escalation over baseline activity (6 victims across the last 100 postings total). Batch publication after a quiet period typically indicates: (a) synchronized detonation of staged intrusions, or (b) negotiation failures across multiple concurrent victims. Either way, expect continued elevated posting tempo over the next 7–14 days as remaining staged intrusions are monetized.

CVE Correlation — Probable Initial Access Vectors

The following CISA KEV entries with confirmed ransomware use align with DIREWOLF's known access methods and this campaign's timing:

• CVE-2026-50751 (Check Point Security Gateway — IKEv1 improper authentication): DIREWOLF's highest-probability edge vector. Unauthenticated access to VPN gateways matches the campaign's geographic spread and the absence of phishing artifacts in known victim reporting.
• CVE-2026-48027 (Nx Console — embedded malicious code): Supply-chain vector of particular concern given the technology-sector victims; a malicious build tool package provides developer-workstation initial access with code-signing trust.
• CVE-2024-1708 (ConnectWise ScreenConnect — path traversal → RCE): RMM abuse is a documented DIREWOLF tradecraft; MSP-deployed ScreenConnect instances provide both access and lateral movement.
• CVE-2025-60710 (Windows link following → privilege escalation) and CVE-2023-21529 (Exchange deserialization): likely post-access privilege escalation and mailbox access roles rather than initial vectors.

Action: If you run Check Point gateways, ConnectWise ScreenConnect, or Nx Console in developer environments and are in a targeted sector, assume elevated targeting probability this week.

Detection Engineering

---
title: DIREWOLF - Check Point VPN Anomalous IKEv1 Authentication (CVE-2026-50751)
id: 8f3a2b11-dw26-0001-a001-9e4f2c110001
status: experimental
description: Detects anomalous IKEv1 authentication patterns against Check Point Security Gateways consistent with CVE-2026-50751 exploitation, a probable DIREWOLF initial access vector.
author: Security Arsenal Threat Intelligence
date: 2026/08/16
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
  product: checkpoint
  service: vpn
detection:
  selection_ike:
    ike_version: 'IKEv1'
    auth_result: 'success'
  filter_known_peers:
    src_ip|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection_ike and not filter_known_peers
falsepositives:
  - Legitimate remote users from new IP ranges; baseline and alert on deviation
level: high
tags:
  - attack.initial_access
  - attack.t1133
  - attack.t1190
---
title: DIREWOLF - Volume Shadow Copy Deletion Pre-Ransomware Behavior
id: 8f3a2b11-dw26-0002-a002-9e4f2c110002
status: experimental
description: Detects vssadmin/wmic shadow copy deletion — DIREWOLF consistently destroys recovery points immediately before encryption detonation.
author: Security Arsenal Threat Intelligence
date: 2026/08/16
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    - Image|endswith: '\vssadmin.exe'
      CommandLine|contains|all:
        - 'delete'
        - 'shadows'
    - Image|endswith: '\wmic.exe'
      CommandLine|contains|all:
        - 'shadowcopy'
        - 'delete'
    - Image|endswith: '\bcdedit.exe'
      CommandLine|contains: 'recoveryenabled no'
  condition: selection_vss
falsepositives:
  - Backup software maintenance windows; correlate with authorized change tickets
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.defense_evasion
---
title: DIREWOLF - PsExec-Style Remote Service Creation for Lateral Movement
id: 8f3a2b11-dw26-0003-a003-9e4f2c110003
status: experimental
description: Detects remote service installation events (Event ID 7045) with randomized service names consistent with PsExec/WMIExec lateral movement observed in DIREWOLF intrusions.
author: Security Arsenal Threat Intelligence
date: 2026/08/16
logsource:
  product: windows
  service: system
  definition: 'Event ID 7045 - A service was installed in the system'
detection:
  selection:
    EventID: 7045
  suspicious_names:
    ServiceName|re: '^[A-Za-z0-9]{6,10}$'
  suspicious_paths:
    ImagePath|contains:
      - '\\ADMIN$\\'
      - '\\C$\\'
      - '%TEMP%'
      - '\AppData\Local\Temp\'
  filter_known:
    ServiceName|contains:
      - 'SCCM'
      - 'BigFix'
      - 'Tanium'
  condition: selection and (suspicious_names or suspicious_paths) and not filter_known
falsepositives:
  - Enterprise software deployment tools; whitelist known management agents
level: high
tags:
  - attack.lateral_movement
  - attack.t1569.002
  - attack.execution
  - attack.t1021

// DIREWOLF Pre-Ransomware Staging Hunt — Microsoft Sentinel
// Hunts for the kill-chain sequence: remote service creation -> shadow copy deletion -> mass file write
// within a 24h window on the same device. Tune LookbackHours for your environment.
let LookbackHours = 72h;
let SuspiciousSvc =
    Event
    | where TimeGenerated > ago(LookbackHours)
    | where EventLog == "System" and EventID == 7045
    | where ServiceName matches regex @"^[A-Za-z0-9]{6,10}$"
       or ImagePath has_any ("ADMIN$", "C$", "Temp")
    | project SvcTime=TimeGenerated, Computer, ServiceName, ImagePath, UserName;
let ShadowDelete =
    SecurityEvent
    | where TimeGenerated > ago(LookbackHours)
    | where EventID == 4688
    | where (Process has "vssadmin.exe" and CommandLine has_all ("delete", "shadows"))
        or (Process has "wmic.exe" and CommandLine has "shadowcopy")
        or (Process has "bcdedit.exe" and CommandLine has "recoveryenabled")
    | project ShadowTime=TimeGenerated, Computer, Process, CommandLine, Account;
let MassFileWrite =
    DeviceFileEvents
    | where TimeGenerated > ago(LookbackHours)
    | where ActionType == "FileRenamed" or ActionType == "FileCreated"
    | summarize WriteCount=count(), FirstWrite=min(TimeGenerated), LastWrite=max(TimeGenerated)
        by DeviceName, bin(TimeGenerated, 1h)
    | where WriteCount > 500
    | project DeviceName, WriteCount, FirstWrite;
SuspiciousSvc
| join kind=inner ShadowDelete on $left.Computer == $right.Computer
| where ShadowTime > SvcTime
| join kind=inner MassFileWrite on $left.Computer == $right.DeviceName
| where FirstWrite > ShadowTime
| project Computer, SvcTime, ServiceName, ImagePath, ShadowTime, Process, CommandLine, FirstWrite, WriteCount
| order by SvcTime desc;

# DIREWOLF Rapid Triage Script — run on suspected compromised Windows hosts
# Checks: shadow copy integrity, recent scheduled tasks, suspicious services, exposed RDP
# Run elevated. Output: consolidated triage report to C:\DIREWOLF-Triage-<hostname>.txt

$report = "C:\DIREWOLF-Triage-$env:COMPUTERNAME.txt"
"=== DIREWOLF Rapid Triage — $(Get-Date) ===" | Out-File $report

# 1. Volume Shadow Copies (DIREWOLF deletes these pre-encryption)
"`n[1] SHADOW COPIES:" | Out-File $report -Append
try {
    $shadows = Get-WmiObject Win32_ShadowCopy -ErrorAction Stop
    if ($shadows) { $shadows | Select-Object InstallDate, DeviceObject | Out-File $report -Append }
    else { "WARNING: NO SHADOW COPIES FOUND — possible anti-recovery action" | Out-File $report -Append }
} catch { "ERROR enumerating shadow copies: $_" | Out-File $report -Append }

# 2. Scheduled tasks created in the last 7 days (persistence mechanism)
"`n[2] SCHEDULED TASKS (last 7 days):" | Out-File $report -Append
Get-ScheduledTask | Where-Object { $_.Date -gt (Get-Date).AddDays(-7) } |
    Select-Object TaskName, TaskPath, Date | Out-File $report -Append

# 3. Services with suspicious short/randomized names (PsExec-style)
"`n[3] SUSPICIOUS SERVICES (6-10 char alphanumeric names):" | Out-File $report -Append
Get-Service | Where-Object { $_.Name -match '^[A-Za-z0-9]{6,10}$' } |
    Select-Object Name, Status, DisplayName | Out-File $report -Append

# 4. RDP exposure and recent RDP logons
"`n[4] RDP CONFIGURATION:" | Out-File $report -Append
$rdp = Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections
"RDP Disabled: $($rdp.fDenyTSConnections) (0 = ENABLED/EXPOSED)" | Out-File $report -Append
$nla = Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -ErrorAction SilentlyContinue
"NLA Enabled: $($nla.UserAuthentication)" | Out-File $report -Append

# 5. Recent logon type 10 (RDP) events — last 48h
"`n[5] REMOTE INTERACTIVE LOGONS (last 48h):" | Out-File $report -Append
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=(Get-Date).AddHours(-48)} -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'Logon Type:\s+10' } |
    Select-Object TimeCreated, @{N='Message';E={$_.Message.Substring(0,[Math]::Min(400,$_.Message.Length))}} |
    Out-File $report -Append

"`n=== Triage complete. Review $report ==="

Incident Response Priorities

T-Minus Detection Checklist (BEFORE Encryption Fires)

DIREWOLF's playbook has a detectable pre-detonation sequence. Hunt for these in order:

1. New local/domain accounts created outside provisioning workflows (especially accounts added to Domain Admins or local Administrators)
2. RMM tool installation not matching your approved software baseline (ScreenConnect, AnyDesk, Splashtop)
3. Bulk data staging — large archives (.zip, .rar, .7z) appearing in C:\ProgramData, user temp directories, or staging shares
4. Anomalous outbound transfer volume to cloud storage (MEGA, pCloud, Rclone endpoints) or unfamiliar IPs on high ports
5. vssadmin/wmic/bcdedit execution — treat ANY shadow copy deletion as a critical-severity page
6. Security tool tampering — EDR service stop attempts, exclusion list modifications, Defender DisableAntiSpyware registry changes
7. Group Policy modification events (4728/5136) pushing scripts or disabling controls

Critical Assets This Gang Prioritizes for Exfiltration

Based on leak-site sample analysis across the victim set:

• Healthcare victims: PHI databases, patient billing records, insurance documentation — high double-extortion leverage
• Financial services (DodoPayments): payment processor credentials, KYC documents, transaction ledgers
• Technology (TOTVS, DXS): source code repositories, customer license databases, and — critically — customer-facing integration credentials that enable downstream supply-chain compromise
• All victims: HR files (passport scans, payroll), executive email archives, legal contracts

Containment Actions — Ordered by Urgency

1. Isolate the affected segment immediately — disable switch ports or apply host firewall blocks; do NOT power off (preserve volatile memory)
2. Disable the suspected initial access account and force enterprise-wide credential reset for any account the intruder touched (assume Kerberos ticket theft — reset krbtgt twice if domain controller compromise is confirmed)
3. Block known DIREWOLF exfil destinations at egress proxy: Rclone endpoint patterns, MEGA.io, pCloud, high-port outbound to non-corporate IPs
4. Kill suspicious services and scheduled tasks identified by the triage script BEFORE broad containment — pre-staged ransomware often detonates on task trigger
5. Preserve evidence: memory capture on patient-zero host, firewall/VPN logs (especially Check Point IKE logs given CVE-2026-50751), RMM agent logs
6. Engage IR retainer before engaging with the threat actor — DIREWOLF negotiators are experienced; amateur negotiation has escalated demands in prior cases

Hardening Recommendations

Immediate (24 hours)

• Patch Check Point Security Gateways against CVE-2026-50751; if patching is not immediately possible, disable IKEv1 in favor of IKEv2 and restrict gateway management interfaces to allow-listed IPs
• Audit all RMM tooling: enumerate every remote access tool present in the environment; remove or flag any that are not on your approved list (ScreenConnect instances must be patched against CVE-2024-1708 and locked to MFA)
• Verify Volume Shadow Copy integrity across servers and enable the Sigma rule above; any deletion event = immediate escalation
• Block macro execution from internet-sourced Office documents via Group Policy; enable Attack Surface Reduction rules in block mode
• Disable Nx Console auto-update / pin to verified versions pending CVE-2026-48027 remediation in developer environments; scan build artifacts for unexpected outbound connections
• Egress filtering: alert on >2GB outbound transfers to consumer cloud storage from server VLANs

Short-Term (2 weeks)

• Segment backup infrastructure onto a separate management network with immutable (WORM or object-lock) backup copies; DIREWOLF targets backup consoles early
• Deploy tiered administration: eliminate standing Domain Admin use from workstations; implement PAWs for server administration
• VPN gateway migration plan: move remote access behind a modern ZTNA/SSE solution with device posture checking — legacy IKEv1 VPN concentrators are this group's bread and butter
• Attack Surface Reduction + EDR in block mode fleet-wide, with tamper protection enforced
• Tabletop the double-extortion scenario: legal, comms, and executive alignment on a data-leak response plan BEFORE you need it — DIREWOLF's leak countdowns run 72–120 hours
• Supply-chain review for technology companies: if you integrate with TOTVS or DXS products, review shared credentials and API keys for rotation

Analyst Assessment

DIREWOLF's single-day, six-victim, four-country posting burst is consistent with a mature RaaS operation running parallel affiliate intrusions, most likely seeded through edge-device exploitation (CVE-2026-50751) weeks prior. The healthcare concentration and the inclusion of a major ERP vendor (TOTVS) suggest deliberate selection for maximum extortion leverage and potential supply-chain downstream. Defenders in the named sectors should assume they are in an active targeting window through the end of August 2026 and operate at heightened detection posture.

Security Arsenal's collection infrastructure continues monitoring DIREWOLF's leak site for new postings. This bulletin will be updated as the campaign evolves.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub