Hunters International
Medium ConfidenceMedium ThreatHunters • World Leaks
Hunters International is a ransomware-as-a-service (RaaS) operation that emerged in October 2023, shortly after the FBI and Europol dismantled the Hive ransomware group in January 2023. Security researchers identified significant code overlaps with Hive ransomware, suggesting that Hunters International either acquired Hive's source code or includes former Hive operators. Hunters International employs double extortion tactics, combining file encryption with data exfiltration. The group primarily targets small to medium-sized businesses, with a particular focus on the manufacturing and healthcare sectors. In July 2025, the group ceased traditional ransomware operations and rebranded as World Leaks, shifting to a pure data extortion model.
Hunters International is a ransomware-as-a-service (RaaS) operation that emerged in October 2023, shortly after the FBI and Europol dismantled the Hive ransomware group in January 2023. Security researchers identified significant code overlaps with Hive ransomware, suggesting that Hunters International either acquired Hive's source code or includes former Hive operators. Hunters International employs double extortion tactics, combining file encryption with data exfiltration. The group primarily targets small to medium-sized businesses, with a particular focus on the manufacturing and healthcare sectors. In July 2025, the group ceased traditional ransomware operations and rebranded as World Leaks, shifting to a pure data extortion model.
Target Sectors
Target Regions
Attributed to Criminal Organization (Unknown). Attribution confidence: Medium.
Future Outlook
Hunters International has rebranded to World Leaks in July 2025, shifting from ransomware to pure data extortion.
Hive ransomware dismantled by FBI/Europol
Hunters International first identified
Significant growth in victim count and operations
Rebranded to World Leaks, shifted to data extortion only