Full Report
Learn about technical details on the ransomware and Storage Software tool, how the criminals use the affiliate panel as well as information on the Hunters International ransomware group from its emergence to the end of the operation.
Analysis Summary
# Threat Actor: Hunters International
## Attribution & Identity
* **Actor Name:** Hunters International
* **Aliases/Associations:** Strongly associated with the defunct **Hive** ransomware operation. Hunters International utilized a source code that was significantly overhauled and simplified from Hive's original code.
* **Successor Group:** **World Leaks** (Launched in January 2025).
* **Identity Notes:** While the group claimed to be an independent entity that purchased Hive's source code, technical analysis indicates it served as a functional successor to Hive's infrastructure and methodology.
## Activity Summary
Hunters International emerged in late 2023 (first observed in October 2023) as a Ransomware-as-a-Service (RaaS) operation. In November 2024, the group announced a formal "closure" due to government scrutiny and decreased profitability. However, the operators remained active, pivoting in January 2025 to a new project called **World Leaks**, which abandoned file encryption in favor of pure data exfiltration and extortion.
## Tactics, Techniques & Procedures
* **Ransomware Development:** Used a simplified, revamped version of the Hive ransomware written in Rust.
* **Cross-Platform Support:** The malware is highly portable, supporting Windows, Linux, FreeBSD, SunOS, and ESXi (VMware), across x64, x86, and ARM architectures.
* **Evasion:**
* Stripping payloads to reduce detection signatures.
* Optionally avoiding ransom notes or file renaming to remain stealthy.
* Use of Tor proxies and TLS for network communication.
* **Extortion:**
* **Double Extortion:** Stilling sensitive data before encrypting files.
* **Pressure Tactics:** Leveraging OSINT to contact victims via phone calls, emails, and social media.
* **Shift to Extortion-Only:** The transition to "World Leaks" marked a move away from encryption (Ransomware) to purely exfiltrating data using custom-built tools.
## Targeting
* **Sectors:** Real Estate, Healthcare, and Professional Services.
* **Geography:** Primarily North America, Europe, and Asia.
* **Exclusion Zones (Reported but inconsistent):** Nominally prohibits attacks on Israel, Turkey, the Far East, and CIS countries, though data leaks suggest these rules are frequently violated.
## Tools & Infrastructure
* **Malware:** **Hunters International Ransomware** (Rust-based); **Storage Software** (Custom exfiltration tool used by World Leaks).
* **Infrastructure:**
* Affiliate panels for RaaS operations.
* Tor-based leak sites.
* C2/Network: TLS-encrypted communications and Tor proxies.
## Implications
The transition from Hunters International to World Leaks highlights a significant strategic shift in the threat landscape: **Extortion-only models.** By abandoning encryption, actors reduce the technical complexity of their attacks and attempt to bypass security solutions focused on detecting cryptographic file activity. The group’s resilience—rebranding despite "closing" operations—demonstrates the persistent nature of Hive-descended threat actors.
## Mitigations
* **Data Protection:** Implement robust, off-site, and immutable backups to counter encryption threats.
* **Exfiltration Detection:** Monitor for large-scale data transfers to unauthorized external IPs or known Tor exit nodes to counter the World Leaks extortion model.
* **Asset Hardening:** Specifically secure ESXi and virtualization environments, as these are high-priority targets for this actor.
* **OSINT Defense:** Educate employees on social engineering and pressure tactics used during the extortion phase.
* **Network Security:** Utilize TLS inspection and monitor for suspicious Rust-based binaries across diverse OS architectures (Windows, Linux, ARM).