# Port of Tanjung Pelepas listed by direwolf ransomware

Published: 2026-09-11 · Severity: elevated · Sectors: infrastructure, transportation
Canonical: https://vorant.io/reports/6c5982f4-592f-5010-827a-fc3207735336/port-of-tanjung-pelepas-listed-by-direwolf-ransomware

> Direwolf ransomware gang claims compromise of Port of Tanjung Pelepas with 322 compromised user accounts and exfiltrated data.

The direwolf ransomware operation has claimed responsibility for compromising the Port of Tanjung Pelepas, a major Malaysian port facility. According to the posting on ransomware.live, the attackers report 10 compromised employees, 322 compromised user accounts, and 34 third-party employee credentials obtained from the environment. The attackers also documented 53 external attack surface findings, indicating significant network exposure. The claim includes DNS records and leak screenshots purporting to show evidence of the compromise. This represents a supply-chain and critical infrastructure targeting incident affecting a major port operator.

Defenders should treat this as confirmation of a breach affecting the organization's authentication systems, employee credentials, and potentially third-party access points. The scale of compromised accounts (322 users) suggests either a credential-dumping incident via an infostealer, a lateral movement campaign within the network, or both. The presence of third-party credentials indicates potential pivot points to connected organizations.

## Mentioned in this report

- Threat actors: Dire Wolf
- Malware: Direwolf

Source reporting: https://www.ransomware.live/id/UG9ydCBvZiBUYW5qdW5nIFBlbGVwYXNAZGlyZXdvbGY=

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/6c5982f4-592f-5010-827a-fc3207735336/port-of-tanjung-pelepas-listed-by-direwolf-ransomware.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup