THREAT OPS › Threat News › [direwolf] EMS1R posted to leak site
[direwolf] EMS1R posted to leak site
Ransomware group: direwolf Victim: EMS1R Victim website: ems1r.com Sector: Not Found Country: US Discovered: 2026-09-08T15:32:19.650582+00:00 Leak-site post: http://direwolfcdkv5whaz2spehizdg22jsuf5aeje4asmetpbt6ri4jnd4qd.onion/api/public/articles/129 Description: Corporate Wellness Services Note: leak-site listings typically precede public disclosure.
Indicators of compromise
- ems1r.comdomain
- http://direwolfcdkv5whaz2spehizdg22jsuf5aeje4asmetpbt6ri4jnd4qd.onion/api/public/articles/129url