THREAT OPS › Threat News › [direwolf] Leafwell posted to leak site
[direwolf] Leafwell posted to leak site
Ransomware group: direwolf Victim: Leafwell Victim website: leafwell.com Sector: Healthcare Country: US Discovered: 2026-08-11T05:55:44.386538+00:00 Leak-site post: http://direwolfcdkv5whaz2spehizdg22jsuf5aeje4asmetpbt6ri4jnd4qd.onion/api/public/articles/81 Description: Hospitals & Physicians Clinics Note: leak-site listings typically precede public disclosure.
Indicators of compromise
- leafwell.comdomain
- http://direwolfcdkv5whaz2spehizdg22jsuf5aeje4asmetpbt6ri4jnd4qd.onion/api/public/articles/81url