# Wolfram Research compromised by direwolf ransomware gang Published: 2026-09-04 · Severity: elevated · Sectors: technology Canonical: https://vorant.io/reports/f9f08c03-e79d-5727-85bb-54b6807943fb/wolfram-research-compromised-by-direwolf-ransomware-gang > Direwolf ransomware operators claim compromise of Wolfram Research with exfiltration of employee and third-party credentials. Ransomware.live, a public tracking platform, reports that the direwolf ransomware gang has claimed a breach of Wolfram Research. According to the posting, the attack resulted in compromise of 6 employee accounts and 45,887 user credentials, along with 4 third-party employee credentials. The attackers report discovery of 104 external attack surface items and DNS records associated with the victim's domain. The listing includes a screenshot purporting to show exfiltrated data. This represents a supply-chain risk scenario where compromise of a technology vendor could expose downstream users and integrations. Defenders should treat this as confirmed intrusion activity against a major software provider. ## Mentioned in this report - Threat actors: Dire Wolf - Malware: Direwolf 1 detection for this report is in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free. Source reporting: https://www.ransomware.live/id/V29sZnJhbSBSZXNlYXJjaEBkaXJld29sZg== --- This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/f9f08c03-e79d-5727-85bb-54b6807943fb/wolfram-research-compromised-by-direwolf-ransomware-gang. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup