DIREWOLF Ransomware Gang: 7 New Victims in 4 Days — Leak Site Analysis, Sector Targeting & Detection Engineering

Classification: TLP:CLEAR | Report Date: 2026-09-10 | Source: ransomware.live dark web leak site monitoring | Analyst: Security Arsenal Threat Intelligence

Executive Summary

Dark web monitoring of the DIREWOLF ransomware gang's .onion leak site shows an active campaign surge: 7 victims posted between 2026-09-07 and 2026-09-09, spanning five sectors and four countries. The clustering of posts — five of seven published within a 72-hour window — is consistent with either a single coordinated intrusion wave or a deliberate batch-dump strategy designed to pressure multiple victims simultaneously by flooding the leak site, maximizing reputational damage and negotiation leverage.

Organizations in Financial Services, Professional Services, Transportation, Education, and Manufacturing — particularly in the US and UK — should treat this as an active-threat notification and execute the 24-hour hardening actions in Section 7 immediately.

1. Threat Actor Profile — DIREWOLF

Analyst Note: The affiliate model matters for defenders. RaaS affiliates reuse playbooks but vary in execution quality. Detection content below targets the highest-fidelity common denominator behaviors: edge exploitation, credential theft, PsExec/WMI lateral movement, data staging, and shadow copy destruction.

2. Current Campaign Analysis

2.1 Victim Posting Timeline

2.2 Sector Targeting

• Financial Services (1/7): RelyComply is an AML/compliance platform — a high-value target. Breaching a compliance vendor creates downstream exposure to its regulated clients (supply chain / third-party risk implications). Any firm using this platform should initiate third-party incident inquiries now.
• Professional Services (2/7): Sales Boomerang and Lightcast are data-aggregation/analytics firms holding large volumes of client PII and business intelligence — classic exfiltration leverage.
• Transportation (1/7): Vehicle logistics — operationally sensitive, high pressure to pay to restore availability.
• Education (1/7) & Manufacturing (1/7): Traditional soft-target sectors with historically weaker segmentation and legacy VPN/RDP exposure.

2.3 Geographic Concentration

US-dominant (4/7), followed by GB, CO, and SE. This matches the standard Western-economy targeting pattern for English-language RaaS operations — victims in jurisdictions with cyber-insurance coverage and strong payment capacity.

2.4 Victim Profile

Victims skew toward mid-market enterprises (estimated 50–1,000 employees, $10M–$500M revenue) — large enough to pay meaningful ransoms, small enough to lack mature 24/7 SOC coverage. Notably, three of the seven (RelyComply, Sales Boomerang, Lightcast) are technology/data platform companies, suggesting either deliberate targeting of data-rich aggregators or opportunistic exploitation of internet-facing SaaS infrastructure.

2.5 Posting Frequency & Escalation

Five posts in a 72-hour burst is an escalation pattern, not steady-state. Two interpretations:

1. Coordinated intrusion wave — a single affiliate or initial access broker (IAB) batch compromised multiple orgs via a common vector and handed access to DIREWOLF operators.
2. Pressure tactic — victims who stalled negotiations were dumped simultaneously to demonstrate credibility.

Either way, the operational tempo indicates DIREWOLF is in an active growth phase and additional posts should be expected through mid-September 2026.

2.6 CVE Correlation — Probable Initial Access Vectors

The following CISA KEV entries are confirmed exploited by ransomware operations and align precisely with the expected DIREWOLF/IAB access chain:

Assessment: The Cisco FMC and Check Point CVEs are the most probable initial access vectors for this campaign — both are internet-facing edge devices, both were KEV-listed within 90 days of the intrusion window, and both match the IAB resale pattern. ScreenConnect exploitation is strongly associated with ransomware deployment at scale and should be treated as a top-three hunt hypothesis in any environment running it.

3. Detection Engineering

3.1 Sigma Rules

---
title: DIREWOLF Ransomware - Suspicious VPN/Firewall Management Interface Authentication Anomaly
id: 8f3a2c1e-d1re-4a01-9b2c-000000000001
status: experimental
description: Detects anomalous authentication and configuration activity against Cisco FMC and Check Point management interfaces consistent with CVE-2026-20316 and CVE-2026-50751 exploitation used for initial access in DIREWOLF campaigns.
author: Security Arsenal Threat Intelligence
date: 2026/09/10
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
  category: authentication
  product: firewall
detection:
  selection_mgmt_auth:
    - src_ip|cidr:
        - '0.0.0.0/0'
    action:
      - 'success'
      - 'accept'
    user|contains:
      - 'admin'
      - 'root'
      - 'fmadmin'
  filter_expected_bastion:
    src_ip|cidr:
      - '10.0.0.0/8'   # TUNE: replace with your management bastion/jump-host ranges
      - '172.16.0.0/12'
  condition: selection_mgmt_auth and not filter_expected_bastion
falsepositives:
  - Legitimate remote administration from unmapped network segments
level: high
tags:
  - attack.initial_access
  - attack.t1190
  - attack.t1078
---
title: DIREWOLF Ransomware - PsExec or WMI Remote Service Creation for Lateral Movement
id: 8f3a2c1e-d1re-4a02-9b2c-000000000002
status: experimental
description: Detects remote service creation via PsExec-style named pipes or WMI process execution, a hallmark of ransomware affiliate lateral movement prior to mass encryption.
author: Security Arsenal Threat Intelligence
date: 2026/09/10
logsource:
  category: process_creation
  product: windows
detection:
  selection_psexec:
    EventID: 7045
    ServiceName|contains:
      - 'PSEXESVC'
      - 'PAExec'
      - 'csexec'
      - 'remcom'
  selection_wmi_remote:
    ParentImage|endswith: '\WmiPrvSE.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\rundll32.exe'
      - '\mshta.exe'
  condition: 1 of selection_*
falsepositives:
  - Legitimate administrative tooling (SCCM, PDQ) - whitelist known deployment accounts/hosts
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1047
  - attack.t1569.002
---
title: DIREWOLF Ransomware - Pre-Encryption Staging - Shadow Copy Deletion and Backup Tampering
id: 8f3a2c1e-d1re-4a03-9b2c-000000000003
status: experimental
description: Detects volume shadow copy deletion, boot configuration tampering, and backup catalog destruction - near-universal pre-detonation behavior in double-extortion ransomware operations.
author: Security Arsenal Threat Intelligence
date: 2026/09/10
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\powershell.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'resize shadowstorage'
      - 'Get-WmiObject Win32_Shadowcopy'
      - 'Remove-WmiObject'
  selection_bcd:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains:
      - 'recoveryenabled no'
      - 'ignoreallfailures'
  selection_wbb:
    Image|endswith: '\wbadmin.exe'
    CommandLine|contains:
      - 'delete catalog'
      - 'delete systemstatebackup'
  condition: 1 of selection_*
falsepositives:
  - Backup maintenance scripts (rare for bcdedit recoveryenabled)
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.t1562

3.2 KQL — Microsoft Sentinel Hunt: Pre-Ransomware Staging & Lateral Movement Chain

// DIREWOLF hunt: correlates edge-device logon -> suspicious tool execution -> mass file staging
// Lookback: 14 days (matches assessed dwell time). Tune allowlists before production use.
let Lookback = 14d;
let SuspiciousTools = dynamic(["psexec", "paexec", "rclone.exe", "megasync", "7z.exe", "winrar.exe", "nltest", "adfind", "sharpview", "mimikatz", "procdump", "comsvcs"]);
// Stage 1: New admin-type sessions on servers from unusual sources
let AnomalousLogons =
    SecurityEvent
    | where TimeGenerated > ago(Lookback)
    | where EventID == 4624 and LogonType in (3, 10)
    | where AccountType == "User"
    | summarize FirstSeen = min(TimeGenerated), Sources = make_set(IpAddress), TargetHosts = make_set(Computer) by Account
    | where array_length(Sources) > 5;  // one account touching 5+ sources = sprayed/stolen creds
// Stage 2: Staging/exfil or lateral tool execution on any host
let ToolExecution =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where FileName has_any (SuspiciousTools)
       or ProcessCommandLine has_any ("delete shadows", "recoveryenabled no", "delete catalog", "/server:", "copy \\")
    | project ToolTime = TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessAccountName, InitiatingProcessCommandLine;
// Stage 3: Mass archive creation (data staging for exfil)
let MassArchive =
    DeviceFileEvents
    | where TimeGenerated > ago(Lookback)
    | where FileName endswith ".zip" or FileName endswith ".7z" or FileName endswith ".rar"
    | summarize ArchiveCount = count(), Hosts = make_set(DeviceName) by InitiatingProcessAccountName, bin(TimeGenerated, 1h)
    | where ArchiveCount > 20;
ToolExecution
| join kind=leftouter AnomalousLogons on $left.InitiatingProcessAccountName == $right.Account
| join kind=leftouter MassArchive on $left.InitiatingProcessAccountName == $right.InitiatingProcessAccountName
| project ToolTime, DeviceName, FileName, ProcessCommandLine, InitiatingProcessAccountName, FirstSeen, Sources, ArchiveCount
| order by ToolTime asc;

3.3 PowerShell Rapid-Response Triage Script

# DIREWOLF Rapid Triage - run on suspected hosts + a domain controller
# Checks: recent scheduled tasks, shadow copy health, suspicious services, RDP exposure
$ErrorActionPreference = 'SilentlyContinue'
$Cutoff = (Get-Date).AddDays(-7)
Write-Output "=== [1] Scheduled Tasks Created/Modified in Last 7 Days ==="
Get-ScheduledTask | Where-Object { $_.Date -and ([datetime]$_.Date) -gt $Cutoff } |
    Select-Object TaskName, TaskPath, Date, @{N='Action';E={$_.Actions.Execute}} | Format-Table -AutoSize

Write-Output "=== [2] Volume Shadow Copy Status (expect copies present on servers) ==="
$shadows = Get-WmiObject Win32_ShadowCopy
if (-not $shadows) { Write-Output "WARNING: ZERO shadow copies found - possible vssadmin deletion (T1490)" }
else { $shadows | Select-Object DeviceObject, InstallDate, VolumeName | Format-Table -AutoSize }

Write-Output "=== [3] Suspicious Services (PsExec-style / random names) ==="
Get-WmiObject Win32_Service | Where-Object {
    $_.Name -match '^(PSEXESVC|PAExec|remcom|csexec|[a-z0-9]{8})$' -or
    ($_.PathName -match 'AppData|Temp|ProgramData' -and $_.State -eq 'Running')
} | Select-Object Name, DisplayName, PathName, StartMode, State | Format-List

Write-Output "=== [4] RDP Exposure Check ==="
$rdpEnabled = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server').fDenyTSConnections
$nla = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp').UserAuthentication
Write-Output ("RDP Enabled: {0} | NLA Enforced: {1}" -f ($rdpEnabled -eq 0), ($nla -eq 1))
if ($rdpEnabled -eq 0 -and $nla -ne 1) { Write-Output "CRITICAL: RDP exposed WITHOUT NLA - immediate brute-force risk" }

Write-Output "=== [5] Recent Failed Logons (brute-force signal) - DC/Server only ==="
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=$Cutoff} -MaxEvents 5000 |
    Group-Object { $_.Properties[19].Value } | Sort-Object Count -Descending |
    Select-Object -First 10 Count, Name | Format-Table -AutoSize

Write-Output "=== Triage complete. If [2] empty OR [3] hits OR [5] >50/source: escalate to IR immediately. ==="

4. Incident Response Priorities — DIREWOLF Playbook

4.1 T-Minus Detection Checklist (Before Encryption Fires)

Escalate immediately if you observe any two of the following:

• Successful admin authentication to firewall/VPN management plane from a non-bastion IP
• New local or domain accounts created outside change windows; accounts added to Domain Admins or Backup Operators
• Execution of vssadmin delete shadows, bcdedit ... recoveryenabled no, or wbadmin delete catalog
• PsExec/WMI service creation across multiple hosts within minutes
• RMM tooling (ScreenConnect, AnyDesk, TeamViewer) present that IT did not deploy
• Bulk archive creation (.zip/.7z/.rar) on file servers, or rclone/megasync processes
• Anomalous outbound traffic volume to cloud storage or unfamiliar ASNs (exfil window typically 24–72h before detonation)
• EDR agents disabled, uninstalled, or stopped reporting

4.2 Assets DIREWOLF-Style Affiliates Prioritize for Exfiltration

Given this campaign's targeting of compliance/data-platform firms, expect priority collection of:

1. Customer databases and PII stores (CRM exports, analytics warehouses)
2. Regulated/compliance data — KYC/AML records (directly relevant given the RelyComply breach)
3. Legal and financial documents — contracts, M&A material, financial statements
4. Email archives of executives and legal counsel
5. Backup catalogs and Veeam/Commvault infrastructure (destroyed to force payment)

4.3 Containment Actions — Ordered by Urgency

1. Isolate at the edge first: Block attacker C2 and exfil egress at the firewall; force-reset all VPN and firewall management credentials (assume CVE-2026-20316/50751 credential exposure).
2. Disable compromised identities: Reset all privileged accounts; revoke and reissue Kerberos (krbtgt double-reset if DA compromise confirmed).
3. Kill lateral movement: Block SMB (445) east-west between workstation VLANs; disable PsExec-named services; quarantine hosts showing tool execution.
4. Protect backups: Take backup infrastructure offline/air-gap immediately; verify restore integrity from the oldest clean snapshot.
5. Preserve evidence: Capture volatile memory and firewall/VPN logs from edge devices before patching or rebooting — edge logs are your best initial-access attribution source.
6. Engage IR counsel early: With a Financial Services victim (AML platform) in the victimology, regulatory notification clocks (FCA, SEC, GDPR for GB/EU data) may already be ticking.

5. Hardening Recommendations

5.1 Immediate (24 Hours)

• Patch or mitigate all five KEV CVEs listed in Section 2.6 — CISA BOD 22-01 timelines apply to federal agencies; treat them as mandatory for your org too. If patching Cisco FMC or Check Point gateways is not possible in 24h, restrict management interfaces to a dedicated bastion VLAN.
• Audit ScreenConnect (CVE-2024-1708): Confirm version ≥ 23.9.8, hunt for rogue ScreenConnect.ClientService instances and unexpected RMM agents fleet-wide.
• Enforce phishing-resistant MFA (FIDO2) on all remote access — VPN, RDP gateways, and RMM consoles.
• Block execution of vssadmin/bcdedit/wbadmin by non-system accounts via WDAC/AppLocker or EDR custom rules.
• Enable firewall management-plane logging to your SIEM if not already — edge device auth anomalies were likely the first observable of this campaign.
• Deploy the Sigma rules and KQL query from Section 3 and run the triage script on DCs, file servers, and backup infrastructure.

5.2 Short-Term (2 Weeks)

• Segment edge management planes: Firewall/VPN admin interfaces must never be internet-reachable; move behind dedicated management VLANs with jump-host-only access.
• Tier-0 identity isolation: Separate admin accounts for DC/backup infrastructure; no Tier-0 logons from workstations.
• Immutable backups: Deploy WORM/object-lock storage with a minimum 30-day retention floor; test a full restore this quarter.
• Egress filtering: Deny-by-default outbound from servers; alert on connections to consumer file-sharing/cloud storage domains.
• RMM allowlisting: Approve exactly one RMM platform; auto-quarantine any other remote access tool execution via EDR.
• Deception controls: Plant honey credentials and canary files on file servers — ransomware affiliates trip these during enumeration and staging, buying you hours of dwell-time detection.

Indicators & Confidence: Victim data sourced directly from DIREWOLF's leak site (high confidence). CVE attribution is correlation-based (moderate confidence) pending victim-disclosed forensics. This briefing will be updated as additional victims post.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub