Office of Public Sector Anti-Corruption Commission listed by direwolf

• Ransomware group: direwolf
• Country: Thailand
• Sector: Government & Defense
• Announcement date: December 22, 2025

The Office of Public Sector Anti-Corruption Commission, a government agency based in Thailand, has been listed on the leak site of the threat actor group known as direwolf. The listing, which appeared on December 22, 2025, indicates a potential cybersecurity incident involving the institution's digital infrastructure.

The claimed attack and event details

According to the announcement made by the direwolf group, the threat actor claims to have successfully targeted the Office of Public Sector Anti-Corruption Commission. The group alleges that they have obtained a significant amount of data from the organization's internal systems. This claim was officially posted on the group's leak site on December 22, 2025, which coincides with the date the group claims the attack took place.

In modern cyberattack scenarios, threat actors often utilize a strategy known as double extortion. In this model, attackers do not merely encrypt an organization's data to disrupt operations; they also exfiltrate sensitive information to a remote server. The threat actor then threatens to publish this stolen data on a public leak site if a ransom is not paid. This tactic increases the pressure on the victim organization, as the threat of a public data leak can cause significant reputational and legal damage, regardless of whether the organization can restore its systems from backups.

The presence of a government institution on a ransomware leak site highlights the growing risks faced by public sector entities. Such incidents can disrupt essential services and compromise the integrity of administrative processes. While the listing is a claim made by the threat actor, it represents a serious potential risk concerning the institution's public sector operations.

Details regarding the allegedly leaked data

Regarding the specifics of the data involved in this incident, the information provided by the threat actor is limited. The direwolf group has not provided any specific details concerning the content or the nature of the files they claim to have stolen. No specific file types or individual documents have been identified in the announcement.

The only concrete detail provided by the group regarding the stolen information is its volume. The threat actor claims that the total size of the data obtained from the organization's systems is 200 GB. Beyond this measurement, the listing names no specific data types.

Organization profile

The Office of Public Sector Anti-Corruption Commission (PACC) is a Thai government agency operating under the Ministry of Justice. The commission is tasked with the critical responsibility of investigating corruption and misconduct involving public sector officials within Thailand.

Impact assessment and organizational considerations

This incident highlights the potential risks associated with data leak claims targeting public institutions. Given the sensitive nature of the work performed by an agency responsible for investigating corruption, the implications of a data breach can be profound. Depending on the actual sensitivity of the leaked data, the organization may face secondary risks such as identity theft or targeted phishing attacks aimed at employees and related third parties.

Furthermore, considering the high data security standards typically expected of public institutions, a situation such as this may lead to the initiation of administrative and legal processes. The loss of sensitive investigative data could undermine the agency's mission and have negative impacts on public trust and institutional reputation.

For organizations within the government and defense sectors, maintaining robust defensive postures is essential. Common defensive steps include implementing strict access controls, maintaining offline backups, and conducting regular security awareness training for staff to prevent initial access via phishing. Additionally, continuous monitoring of network traffic can help detect unauthorized data exfiltration attempts before large volumes of data are moved out of the network.

Public information regarding the direwolf group remains limited, making it difficult to attribute the attack to a specific known entity or to predict their future patterns. However, the targeting of a high-profile government agency underscores the necessity for continuous vigilance in the public sector.