DireWolf

Active
82 victims named on the leak site
11 in the last 30 days
50 in the last 12 months
May 2025 first victim we recorded
Aug 12, 2026 most recent victim posted
2 leak sites tracked

Data as of August 16, 2026.

Credential exposure before the attack

11% of DireWolf victims whose domain we can identify (9 of 82) had employee credentials leak in the 12 months before DireWolf named them as a victim.

We don't know whether any of these credentials were how DireWolf gained initial access.

What industries DireWolf targets

Sector identified for 64 of 82 victims.

Manufacturing17
Healthcare11
Financial Services9
Legal6
Logistics6
Construction6
Technology2
Energy1

Where the victims are located

Country identified for 70 of 82 victims.

Malaysia8
Thailand7
United States7
Brazil5
Taiwan5
Singapore4
Turkey4
United Kingdom4

Most recent DireWolf victims

VictimSectorCountryPosted
BigSpark bigspark.aiTechnologyUnited KingdomAug 12, 2026
Leafwell leafwell.comHealthcareUnited StatesAug 12, 2026
AliveCor alivecor.comHealthcareUnited StatesAug 11, 2026
Chat Jurídico chatjuridico.com.brNot identifiedBrazilAug 11, 2026
Fondo fondo.comFinancial ServicesUnited StatesAug 11, 2026
Health Carousel healthcarousel.comHealthcareUnited StatesAug 11, 2026
Merge Money merge.moneyNot identifiedUnited KingdomAug 11, 2026
Osmo osmomoney.comNot identifiedNot identifiedAug 11, 2026
Quironsalud quironsalud.comHealthcareSpainAug 11, 2026
Statista statista.comNot identifiedGermanyAug 11, 2026
Swyft swyft.comTechnologyUnited StatesAug 11, 2026
Clínica Vida clinicavida.comHealthcareColombiaJun 15, 2026
D.I.D Asia didasia.co.thManufacturingThailandJun 15, 2026
Jewelex jewelexgroup.comManufacturingIndiaJun 15, 2026
Nueva Pescanova nuevapescanova.comRetailSpainJun 15, 2026
Chemsain Konsultant chemsain.comNot identifiedMalaysiaJan 14, 2026
Perdana Petroleum Berhad perdana.myLogisticsMalaysiaJan 14, 2026
Tepco Group tepco-group.comConstructionEgyptJan 14, 2026
Bauerfeind bauerfeind.caHealthcareCanadaJan 12, 2026
Mohammad Omar Bin Haider Holding Group mobhholding.comFinancial ServicesGermanyJan 12, 2026

Showing the 20 most recent of 82. Browse recent data breaches for more.

DireWolf leak sites

Addresses we've seen DireWolf publish victims from. Any .onion address needs the Tor Browser.

  • direwolfcdkv5whaz2spehizdg22jsuf5aeje4asmetpbt6ri4jnd4qd.onion
  • direwolfgpyqohwxwoetsz7a6p72diu32c3wfysqdx4ei6bwft7zh3yd.onion

DireWolf questions

Is DireWolf still active?

Yes. DireWolf posted its most recent victim on August 12, 2026. That's 11 victims in the last 30 days.

How many victims has DireWolf claimed?

DireWolf has named 82 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 50 of them were posted in the last 12 months.

When did DireWolf first appear?

The first victim we recorded for DireWolf was posted on May 28, 2025. That's when the group entered our collection, which isn't necessarily when it started operating.

Which sectors does DireWolf target?

Manufacturing accounts for the most victims we can classify, with 17. Healthcare follows at 11. We could identify a sector for 64 of 82 victims, so treat this as the shape of the targeting rather than a full census.

Has DireWolf already got your credentials?

Check whether your employees' logins have leaked on the dark web before they're exploited.

Check your exposure →

Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.