← Back to all threat actors

werewolves

WereWolves is a Russian-speaking ransomware group that emerged in May 2023, using a modified LockBit 3 (Black) encryptor, operating an unusual public website that actively recruits new members and offers a bug-bounty program with rewards up to $1 million, with at least 26 victims across Russia, the US, and Europe.

How we source and review actor profiles

Motivation

ransomware

Last seen

2024-03-04

Sectors

professional-services, technology, financial-services, hospitality, manufacturing, retail-e-commerce, healthcare, energy-utilities

Status

Dormant

Activity timeline

A dated ledger of actor-claimed victims, campaigns, indicators, identity mappings, relationships, and CVE links. Each date states what it measures. For extensive leak-site histories, victim entries are limited to the 100 most recent distinct listings.

2024-03-04Claimed

Victim claimvsexshop.ru listed by werewolves

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2024-03-04Last observed

Indicator2 indicators cataloged

Types: domain.

2024-02-14Claimed

Victim claimdavidsbridal.com listed by werewolves

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2023-12-22Claimed

Victim claimsolveindustrial.com listed by werewolves

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2023-12-17Claimed

Victim claimvasexperts.ru listed by werewolves

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2023-12-15Claimed

Victim claimforabank.ru listed by werewolves

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2023-11-02Claimed

Victim claimauditexpertnn.ru listed by werewolves

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2023-11-02Claimed

Victim claimpromproektspb.ru listed by werewolves

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2023-10-14Claimed

Victim claimkailos.ru listed by werewolves

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2023-10-14Claimed

Victim claimgaztranscom.ru listed by werewolves

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2023-10-04Claimed

Victim claimatol.ru listed by werewolves

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2023-09-30Claimed

Victim claimroomhotel-sochi.ru listed by werewolves

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2023-09-29Claimed

Victim claimcarmoney.ru listed by werewolves

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2023-09-27Claimed

Victim claimcroc.ru listed by werewolves

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2023-09-27Claimed

Victim claimmaritimebank.com listed by werewolves

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2023-09-24Claimed

Victim claimhabarovsk.amaks listed by werewolves

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2023-09-22Claimed

Victim claimavrora24.ru listed by werewolves

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2023-09-14Claimed

Victim claimkrasnoyarsk.amaks listed by werewolves

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2023-09-13Claimed

Victim claimacac.com listed by werewolves

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2023-08-28Claimed

Victim claimlapostemobile.fr listed by werewolves

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2023-08-04Claimed

Victim claimemprint.com listed by werewolves

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2023-07-01Claimed

Victim claimqb2b.ru listed by werewolves

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2023-06-17Claimed

Victim claimlzaim38.ru listed by werewolves

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2023-05-25Claimed

Victim claiminterfides.de listed by werewolves

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2023-05-24Claimed

Victim claimmetalnet.nl listed by werewolves

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

The interactive view includes 27 dated events with category filters and paging.

Identity and attribution

Exact names and tracking identifiers resolve to this canonical profile. Rebrands, affiliations, and overlapping clusters remain separate confidence-rated relationships.

Name map

werewolvesCanonical Name

Loading CVEs, techniques, indicators, malware, victims, and activity...