RegistroCiberVE
All incidents
unconfirmed ransomware or data leak claim Claim date: Date confidence: Low

Presunta exfiltración de datos de Coral atribuida a Dire Wolf

Una supuesta exfiltración de datos de la distribuidora venezolana Coral, C.A. fue reivindicada en un listado del portal atribuido a Dire Wolf el 13 de noviembre de 2025. RedPacket conservó al día siguiente una copia automatizada del listado, que alegaba exfiltración y 160 GB y remitía a un sitio onion; FalconFeeds publicó una captura del portal, BreachSense registró el mismo actor, dominio y volumen, BlackFog incluyó a Coral entre las víctimas reclamadas y un resumen semanal de CLeaRSky la marcó como filtrada. Ninguna fuente revisada expone el corpus, una muestra, hashes, telemetría, prueba de cifrado o confirmación de Coral. El registro conserva el reclamo, no confirma intrusión, exfiltración, publicación de datos, interrupción ni pérdidas.

Overview

Missing evidence

entrada original recuperable del portal Dire Wolf o captura autenticada completaarchivo o muestra con hashes, manifiesto, cadena de custodia y validación seguravalidación de origen en Coral y del volumen de 160 GBtelemetría de acceso, vector inicial, cifrado o exfiltracióndeclaración de Coral, autoridad venezolana, CERT, regulador o corroboración técnica independienteevidencia de publicación, interrupción, personas, sistemas o pérdidas

Impact details

El listado alega exfiltración y 160 GB, y el resumen de CLeaRSky lo marca como filtrado, pero no se recuperaron archivos, muestras, hashes, manifiesto, cadena de custodia o validación del origen. No se verificaron acceso, cifrado, contenido, volumen, publicación, personas, sistemas, interrupción ni pérdidas. La disponibilidad operacional permanece desconocida; no equivale a continuidad normal confirmada.

Classification & severity

Category
Undetermined
Subtype
unconfirmed ransomware or data leak claim
Confidence
Low

Varias fuentes preservan el mismo listado de Dire Wolf, pero ninguna demuestra intrusión, ejecución de ransomware, cifrado, exfiltración o publicación de datos.

Severity assessment

Information impact
Suspected

Sin corpus, muestra, autenticidad, alcance, telemetría, confirmación oficial o efecto observado, el listado no permite estimar gravedad.

Data exfiltration· Claimed

Timeline

Claim

El portal atribuido a Dire Wolf incluyó a Coral, C.A.; RedPacket preservó un reclamo de exfiltración y 160 GB, sin archivos ni validación.

Evidence & sources

5 sources

[DIREWOLF] - Ransomware Victim: Coral

RedPacket Security Nov 14, 2025
Primary Security research Source confidence: Medium

What this source supports

  • preserves an automated scrape naming Coral, coral.com.ve, Venezuela and Dire Wolf
  • records an underlying leak-site claim timestamp of 13 November 2025
  • reports the actor claim of exfiltration and 160 GB and a link to an onion distribution site
  • states that the supplied scrape contained no images, screenshots or other attachments

Evidence limits

This faithfully preserves the actor listing but is derived from it. No file, sample, hash, chain of custody, technical telemetry, victim confirmation or independent validation establishes access, encryption, exfiltration, content, volume or publication.

Relevance to this case

Strongest recoverable target-specific textual preservation of the claim, including its timestamp and alleged 160-GB scale.

Coral Data Breach in 2025

BreachSense Nov 14, 2025
Corroborating Security research Source confidence: Medium

What this source supports

  • records coral.com.ve as a victim claimed by DireWolf
  • displays discovery on 14 November 2025 and an alleged leak size of 160GB
  • describes Coral as a Venezuelan distributor

Evidence limits

Commercial tracker of the same public listing; it provides no original post, file, sample, technical validation or victim statement and does not independently establish compromise or exfiltration.

Relevance to this case

Corroborates circulation of the same Coral/DireWolf/160GB allegation one day after the actor listing.

Ongoing: New Ransomware Gangs in 2025

BlackFog / Rebecca Harpur Jan 1, 2026
Context Security research Source confidence: Low

What this source supports

  • lists Coral, C.A. under Dire Wolf victims claimed

Evidence limits

The roundup provides no target date, domain, volume, original actor URL, screenshot, file, methodology or victim confirmation.

Relevance to this case

Contextual corroboration that Coral appeared in public monitoring as a Dire Wolf claimed victim, not independent evidence of compromise.

FalconFeeds.io: Dire Wolf adds Coral, C.A. to its dark-web portal

FalconFeeds.io / X Nov 13, 2025
Corroborating Media report Source confidence: Medium

What this source supports

  • visible post says Dire Wolf added three victims to its dark-web portal and explicitly names Coral, C.A. with the Venezuelan flag
  • the single attached image visibly reproduces three Dire Wolf portal cards dated 2025-11-13, including Coral

Evidence limits

FalconFeeds independently preserves that it observed the listing, but it is a secondary monitoring post derived from the same actor portal. The card does not show files, samples, 160 GB, access, encryption or impact.

Relevance to this case

Exact browser-verified contemporaneous corroboration that Coral appeared on the Dire Wolf portal.

CLeaRSky Cyber Security weekly ransomware summary, 23 November 2025

CLeaRSky Cyber Security / Scribd uploader erangoldman
Context Security research Source confidence: Low

What this source supports

  • the Dire Wolf table names Coral, C.A., Venezuela, estimated date 2025-11-13 and sector marketing of prestigious brands
  • the table labels Coral as Leaked without exposing supporting files, samples or methodology

Evidence limits

Tertiary weekly compilation with no cited original URL, sample, artifact, validation method or victim confirmation. Its categorical Leaked label is recorded but not accepted as proof.

Relevance to this case

Target-specific context matching Coral, Dire Wolf, Venezuela and 13 November; not independent breach verification.