# Aztec Software hit by direwolf ransomware Published: 2026-08-21 ยท Severity: elevated Canonical: https://vorant.io/reports/e80219b4-a937-586b-89f3-ae6a2be37d32/aztec-software-hit-by-direwolf-ransomware > Direwolf ransomware operators claim compromise of Aztec Software with 941 exposed user credentials and 22 external attack surface exposures. Ransomware.live, a platform that indexes publicly disclosed ransomware incidents, reports that Aztec Software has been compromised by the direwolf ransomware operation. The incident resulted in exposure of 941 user credentials and identification of 22 external attack surface exposures within the victim's infrastructure. No compromised employee accounts were directly noted, but the scale of credential exposure suggests potential for lateral movement and further compromise. The direwolf group has posted this incident on public ransomware leak sites, indicating data exfiltration and extortion demand. Defenders should treat this as confirmation that Aztec Software infrastructure was breached and data was stolen; any organization using Aztec Software services or integrations should assess whether their own credentials or data passed through affected systems. ## Mentioned in this report - Threat actors: Dire Wolf - Malware: Direwolf 1 detection for this report is in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free. Source reporting: https://www.ransomware.live/id/QXp0ZWMgU29mdHdhcmVAZGlyZXdvbGY= --- This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/e80219b4-a937-586b-89f3-ae6a2be37d32/aztec-software-hit-by-direwolf-ransomware. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup