Full Report
“After careful consideration and in light of recent developments, we have decided to close the Hunters International project,” the prolific cybercrime gang wrote on its darknet site.
Analysis Summary
# Threat Actor: Hunters International
## Attribution & Identity
- **Known Aliases/Associations:** Potentially a rebrand of, or closely associated with, the **Hive** ransomware operation. Users on underground forums referred to Hunters International as "хайв" (Hive in Russian). Administrators allegedly used the same instant messaging account associated with Hive operators.
- **Successor/Related Group:** Administrators are allegedly planning/launching an extortion-only service named **World Leaks**, which shares the same site design as Hunters International.
## Activity Summary
Hunters International operated for nearly two years, attempting to extort at least hundreds of victims. The group recently announced it was shutting down and providing free decryption software, though the efficacy of this software is reportedly low ("poorly designed"). The group previously announced a shutdown in November but failed to close operations then. Their immediate successor appears to be World Leaks.
## Tactics, Techniques & Procedures
- The provided text focuses on the **business closure/rebranding** aspect rather than specific technical execution, but the core activity is **Ransomware/Extortion**.
- **Implied TTP:** Ransomware deployment leading to data encryption and subsequent double extortion (implied by the nature of the group).
- **Attribution Link:** Possesses code similarities with the defunct Hive operation.
- **Motivation/Objective:** Financial extortion (implied by the ransomware model).
## Targeting
- **Sectors:** Not explicitly detailed, but victims include a prominent **cancer center** and a US federal agency.
- **Geography:** Implied broad international targeting, evidenced by involvement with US entities.
- **Victims:**
- A prominent cancer center based in Seattle.
- The U.S. Marshals Service.
## Tools & Infrastructure
- **Malware Families used:** Hunters International Ransomware (and potentially associated with Hive malware).
- **Infrastructure (C2, domains, IPs):**
- Operated a darknet extortion site associated with the group.
- The successor, World Leaks, currently operates a site using the same design.
## Implications
The announcement of closure and free decryption utility should be met with skepticism, as it may be a tactic to evade law enforcement scrutiny following the takedown of linked groups (like Hive) or simply a precursor to rebranding (as seen with the launch of World Leaks). The potential link to Hive suggests that experienced operators are shifting focus to a new model (extortion-only service via World Leaks).
## Mitigations
- **Assume persistence:** Organizations interacting with defunct ransomware groups should monitor for rebranding activities (e.g., World Leaks).
- **Data Recovery Plans:** Due to the stated poor quality of the offered decryption tools, organizations should rely on established backups and professional incident response services rather than group-provided utilities.
- **Threat Intelligence Monitoring:** Monitor underground forums for activity associated with Hive operators or the new World Leaks operational structure.