Hunters International was a ransomware-as-a-service operation that surfaced in October 2023 and is widely assessed to be built on the source code and infrastructure of the Hive ransomware group, which an FBI-led operation disrupted in January 2023. Over roughly eighteen months it ran a double-extortion model and claimed on the order of 200 to 300 victims. Through late 2024 and into 2025 the operators concluded that encryption-based ransomware had become too risky and insufficiently profitable, and pivoted to a pure data-theft and extortion model rebranded as World Leaks. On 3 July 2025 the Hunters International brand announced it was shutting down and offered free decryptors to past victims.
Hive Lineage
When Hunters International emerged in October 2023, researchers quickly flagged substantial code overlap with Hive, and Bitdefender published analysis describing it as Hive’s offspring. The group itself stated it had acquired Hive’s older source code and website. The link is strongly indicated, group-confirmed and code-corroborated — one researcher cited roughly 60% code overlap as an informal estimate — rather than forensically proven lineage.
Barracuda reported Hunters fixed decryption-reliability bugs in Hive’s logic, reduced command-line parameters, streamlined key storage, and shifted the cryptography from ChaCha20-Poly1305 toward an AES-plus-RSA scheme. The Rust-based encryptor was cross-platform.
Timeline
- Jan 2023. Hive disrupted by an FBI-led international operation.
- Oct 2023. Hunters International emerges; code overlap with Hive flagged.
- Nov 2024. Operators reportedly signal intent to wind down (Group-IB).
- 1 Jan 2025. World Leaks launched as an extortion-only brand; public leak-site activity is tracked from around May 2025 — reconcile as branding in January, visible activity from May.
- Jun 2025. The Chain IQ procurement-supplier breach exposed UBS and other companies’ data; attribution to World Leaks is press and Group-IB level, not official.
- 3 Jul 2025. The Hunters International brand announces shutdown and offers free decryptors; analysts widely read the gesture as a low-cost exit since most victims had already recovered.
The Extortion-Only Pivot
World Leaks drops the encryptor and keeps the leverage. Affiliates were provided a purpose-built, Rust-written exfiltration tool for automated data theft — described by Group-IB as able to route traffic through a proxy and to run across Windows, Linux, FreeBSD and SunOS on multiple architectures, an evolution of the earlier Hunters “Storage Software” utility. The operator claim that the tool is “fully undetectable” should be treated skeptically, and the no-encryption line is not absolute: Lexfo reportedly found some World Leaks victims that still had ransomware deployed before extortion.
MITRE ATT&CK Mapping
Access vectors are affiliate-driven and vary per intrusion; the mapping below is representative, not a confirmed single chain.
| Tactic | Technique | Usage |
|---|---|---|
| Initial Access | T1078 Valid Accounts | Affiliate access |
| Initial Access | T1190 Exploit Public-Facing Application | Affiliate access |
| Collection | T1074 Data Staged | Staging before theft |
| Command and Control | T1090 Proxy | Exfiltration tool routing |
| Exfiltration | T1567.002 To Cloud Storage | Automated data theft |
| Impact | T1486 Data Encrypted for Impact | Encryption era / mixed cases |
| Impact | T1657 Financial Theft | Extortion |
Notable Incidents
Counts conflict across sources: roughly 200 to 300 claimed or attempted victims, with about 55 confirmed. Healthcare is heavily represented; one third-party estimate put more than 3.25 million personal records compromised across the campaign. Present these as a range with the confirmed-versus-claimed distinction.
In June 2025, the procurement supplier Chain IQ — spun off from UBS in 2013 — was breached along with around nineteen other companies, exposing UBS employee data. The widely cited figure of 130,000 affected UBS staff originates with a Swiss newspaper and was not confirmed by UBS, which stated that no client data was affected. Attribution to World Leaks is press and Group-IB level, not an official attribution, and it is a sharp reminder that supplier access is in scope.
Detection Signals
- Rust-compiled cross-platform binaries performing bulk recursive file enumeration and metadata collection.
- Outbound bulk data transfer routed through proxy or relay infrastructure to attacker-controlled panels.
- Large-scale staging and compression of documents before exfiltration.
- In the encryption era, mass encryption with a Hive-descended encryptor and attempts to inhibit recovery. Take current hashes and indicators from Group-IB, Bitdefender, Acronis or Lexfo write-ups.
Detection & Mitigation
- Monitor for anomalous large-volume outbound transfers and unusual proxying from file servers and endpoints.
- Extend EDR coverage to Linux, FreeBSD and Solaris, not just Windows — the exfiltration tooling is cross-platform.
- Apply data-loss-prevention controls on document repositories and alert on bulk access, staging and compression.
- Harden affiliate initial-access vectors: MFA on all remote access, patch public-facing applications, and monitor for valid-account abuse.
- Keep offline and immutable backups, and treat third-party and supplier access as in-scope for vendor risk management and breach notification.
Defend Against Data Extortion
Mjolnir Security helps organisations detect bulk data theft and respond to extortion, whether or not encryption is involved.
- Managed Detection and Response Monitoring for bulk file enumeration, staging and proxied exfiltration across Windows, Linux and Unix hosts.
- Third-Party and Supplier Risk Review Assessment of vendor access and data sharing against supplier-breach scenarios like Chain IQ.
- 24/7 Incident Response Containment and negotiation support when data extortion is detected. Call +1 833 403 5875.
Stay ahead of emerging threats. Get notified when we publish new intelligence reports and advisories.
Subscribe to Alerts