Reddit NetSec

CVE Database V5

AlienVault OTX General

Exploit-DB RSS Feed

Reddit InfoSec News

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A newly emerged ransomware group called Dire Wolf has been observed since May 2025, targeting multiple sectors globally with a focus on manufacturing and technology. The group employs double extortion tactics, encrypting files and threatening to publish stolen data. Analysis of a Dire Wolf ransomware sample revealed it was written in Golang and uses a combination of Curve25519 and ChaCha20 algorithms for encryption. The malware disables event logging, terminates specific processes and services, and deletes backups and recovery options. Victims are given personalized ransom notes with login details for negotiation. As of writing, 16 victims across 11 nations have been listed on the group's leak site, with the US and Thailand being the most affected.

Dire Wolf is a newly identified ransomware group first observed in May 2025, targeting multiple global sectors with a particular focus on manufacturing and technology industries. The group employs double extortion tactics, meaning they not only encrypt victims' files but also exfiltrate sensitive data and threaten to publicly release it if the ransom demands are not met. Technical analysis of a Dire Wolf ransomware sample reveals it is written in the Go programming language (Golang), which facilitates cross-platform capabilities and ease of deployment. The malware uses strong cryptographic algorithms, specifically Curve25519 for key exchange and ChaCha20 for symmetric encryption, ensuring robust encryption that is difficult to break. 

The ransomware disables event logging to hinder detection and forensic analysis, terminates specific processes and services to maximize encryption success and prevent recovery, and deletes backups and recovery options to increase pressure on victims to pay. Victims receive personalized ransom notes that include login credentials for negotiation portals, indicating a professionalized and organized extortion operation. As of the latest reports, Dire Wolf has publicly listed 16 victims across 11 countries on its leak site, with the United States and Thailand being the most affected. While no known exploits or CVEs are associated with this ransomware, its tactics align with MITRE ATT&CK techniques such as data destruction (T1489), disabling security tools (T1562.002), and data encryption for impact (T1486). The group’s operational security and use of advanced cryptography suggest a sophisticated threat actor capable of causing significant disruption.

Detailed information about Dire Wolf Strikes: New Ransomware Group Targeting Global Sectors. Get real-time updates, technical details, and mitigation strategies

Dire Wolf Strikes: New Ransomware Group Targeting Global Sectors - Live Threat Intelligence - Threat Radar | OffSeq.com

Dire Wolf Strikes: New Ransomware Group Targeting Global Sectors

In May 2025, Pakistan-linked hacktivist groups claimed over 100 cyberattacks on Indian government, education, and critical infrastructure websites. However, an investigation reveals most breaches were exaggerated or fake. Alleged data leaks contained primarily public information, website defacements left no real impact, and DDoS attacks caused minimal disruption. The more significant threat came from APT36, which used Crimson RAT malware to target Indian defense networks following the Pahalgam terror attack. The malware, delivered through phishing emails with malicious attachments, allows remote execution of commands and data exfiltration. While hacktivist claims generated alarming headlines, the actual impact was limited, with most targeted websites operating normally.

In May 2025, a surge of cyberattacks was publicly claimed by Pakistan-linked hacktivist groups targeting Indian government, education, and critical infrastructure websites. These claims included over 100 attacks involving data leaks, website defacements, and distributed denial-of-service (DDoS) attacks. However, detailed investigations revealed that most of these breaches were either exaggerated or entirely fabricated. The alleged data leaks primarily contained publicly available information, defacements caused no lasting operational damage, and DDoS attacks resulted in only brief and minimal disruptions. The more significant and credible threat originated from the advanced persistent threat (APT) group APT36, which deployed the Crimson RAT malware to target Indian defense networks, particularly following the Pahalgam terror attack. Crimson RAT is a remote access trojan that enables attackers to execute commands remotely, maintain persistence, harvest credentials, and exfiltrate sensitive data. The malware was primarily delivered through phishing campaigns involving malicious email attachments, leveraging social engineering tactics rather than exploiting software vulnerabilities. The attack techniques align with MITRE ATT&CK tactics such as T1566.002 (phishing with malicious attachments), T1547.001 (boot or logon autostart execution), T1041 (exfiltration over command and control channels), and T1071.001 (web protocol communication). Indicators of compromise include suspicious domains mimicking official Indian defense and government email infrastructure, suggesting attempts at credential phishing or command and control communication. Despite the media attention on hacktivist claims, the actual operational impact was limited, with most targeted websites remaining functional and no widespread compromise beyond the targeted defense networks. No known exploits in the wild or patches are currently associated with this threat, and the attack vector relies heavily on social engineering rather than software vulnerabilities. This campaign highlights the tactical use of cyber operations by nation-state affiliated groups to conduct espionage and targeted intrusions rather than broad disruptive campaigns.

Detailed information about Brief Disruptions, Bold Claims: The Tactical Reality Behind the India-Pakistan Hacktivist Surge. Get real-time updates, technical det

Brief Disruptions, Bold Claims: The Tactical Reality Behind the India-Pakistan Hacktivist Surge - Live Threat Intelligence - Threat Radar | OffSeq.com

Brief Disruptions, Bold Claims: The Tactical Reality Behind the India-Pakistan Hacktivist Surge

Interlock Ransomware has recently targeted National Defense Corporation and its subsidiaries, impacting the defense industrial base supply chain. The group's attack on AMTEC, a manufacturer of ammunition and explosives, has exposed sensitive information about global defense contractors and their supply chains. This incident highlights the cascading effects of such attacks on military operations, national security, and intellectual property. The compromised data includes details about contracts, logistics, and distribution networks of major defense corporations. The attack underscores the critical need for robust cybersecurity measures in the defense sector, especially given the potential involvement of state-sponsored actors and the implications for geopolitical influence and espionage.

Interlock Ransomware is a sophisticated ransomware threat actor that has recently targeted entities within the defense industrial base (DIB), specifically focusing on National Defense Corporation and its subsidiaries such as AMTEC, a manufacturer of ammunition and explosives. The attack methodology involves encrypting critical operational data and simultaneously exfiltrating sensitive information related to defense contractors, including contract details, logistics, and distribution networks. This double extortion tactic not only disrupts the availability of essential systems but also threatens confidentiality by threatening to leak intellectual property and sensitive supply chain data. The ransomware campaign appears to leverage a combination of tactics including lateral movement (T1133), service stop (T1489), exploitation of public-facing applications (T1190), data from local system (T1567), remote services (T1021), data destruction (T1491), data manipulation (T1565), valid accounts (T1078), data encrypted for impact (T1486), and data exfiltration (T1490). The absence of known affected software versions or publicly known exploits suggests the adversary may be exploiting zero-day vulnerabilities, supply chain weaknesses, or social engineering vectors to gain initial access. The use of multiple IP addresses and a Tor-based leak site for publishing stolen data indicates a high level of operational security and sophistication, possibly pointing to state-sponsored involvement. The attack has cascading effects on military operations and national security by compromising the integrity and confidentiality of defense supply chains, potentially delaying or degrading defense readiness and exposing strategic defense capabilities to adversaries. This threat highlights the critical need for enhanced cybersecurity frameworks such as CMMC compliance within the defense sector to mitigate risks associated with ransomware and data leaks.

Detailed information about How Interlock Ransomware Affects the Defense Industrial Base Supply Chain. Get real-time updates, technical details, and mitigation s

Title	Severity	Type	Source	Date

Threats Tagged 'data leak'

Filter Threats

Threats Tagged 'data leak'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility