direwolf

Firma de detección defensiva para este grupo (úsala en tu EDR/SIEM). Fuente: ransomware.live.

/*
direwolf ransomware
*/

rule direwolf_Ransomnote
{
    meta:
        author = "ransomware.live"
        family = "ransomware.direwolf"
        description = "Detects direwolf ransomware ransom note or artifact"
        date = "2026-05-04"
        severity = 7
        score = 70

    strings:
        $name1 = "direwolf" ascii nocase
        $name2 = "DIREWOLF" ascii
        $onion  = "direwolf.onion" ascii nocase

    condition:
        any of them
}

Dear Mr or Ms,
If you are reading this message, it means that:
      - your network infrastructure has been compromised
      - critical data was leaked
      - We decrypted your encrypted files. The anti-leakage system is useless to us. We can provide proof.
      - files are encrypted
--------------------------------------------------------------------------
            The best and only thing you can do is to contact us
              to settle the matter before any losses occurs.
--------------------------------------------------------------------------
We can maintain confidentiality for 3 days for you, during which we will not disclose any information about your intrusion or data leakage.
We can extend the confidentiality period free of charge until we reach an agreement if you contact us within 3 days and communicate effectively with us.
If the confidentiality period expires, we will disclose the relevant information.
We provide complimentary decryption testing services. For specific details, please contact us.
--------------------------------------------------------------------------
We have provided a sample document as proof of our possession of your files and you can download and check it:
	- [redactado]
Please be advised that your files are scheduled for public release after 30 working days.
If you want to secure your files, we urge you to reach out to us at your earliest convenience.
--------------------------------------------------------------------------
Contact Details:
	- live chat room:
		- url:[redactado]
		- roomID: [snip]
		- username: [snip]
		- password: [snip]
--------------------------------------------------------------------------
Our official website:
	- url:[redactado]
--------------------------------------------------------------------------
How to access .onion website:
	1.Download and install TOR Browser [redactado]
	2.Open it and try to access our onion address
	3.Maybe you need to use VPN if it can not open our onion address

• https://www.ransomware.live/group/direwolf

• Transportation/Logistics
  2
• Business Services
  2
• Energy
  1
• Education
  1