Werewolves is a Russian-speaking ransomware group known for using a modified LockBit 3 encryptor.
Werewolves is a Russian-speaking ransomware group that emerged in May 2023. The group primarily targets victims across Russia, the US, and Europe. They utilize a modified LockBit 3 (Black) encryptor and operate an unusual public website for active recruitment, along with a bug-bounty program offering rewards up to $1 million. Defenders should enhance monitoring for LockBit-specific TTPs, focus on threat intelligence related to their recruitment and bounty announcements, and ensure robust offline backups of critical systems against potential ransomware attacks.
WereWolves is a Russian-speaking ransomware group that emerged in May 2023, using a modified LockBit 3 (Black) encryptor, operating an unusual public website that actively recruits new members and offers a bug-bounty program with rewards up to $1 million, with at least 26 victims across Russia, the US, and Europe.
The group utilizes a modified LockBit 3 (Black) encryptor.
Defenders should enhance monitoring for LockBit-specific TTPs, focus on threat intelligence related to their recruitment and bounty announcements, and ensure robust offline backups of critical systems.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.