Hunters International is a highly aggressive Ransomware-as-a-Service (RaaS) operation that emerged in October 2023 following the FBI’s disruption of the Hive ransomware group. Security researchers discovered that Hunters International’s code contains approximately 60% overlap with Hive ransomware version 61, suggesting the group acquired or inherited Hive’s source code. The group operates globally, targeting organizations across multiple industries with a double-extortion strategy: stealing sensitive data, encrypting systems using Rust-based ransomware, and threatening to publish stolen information on their dark-web leak site unless ransom demands are met. As of early 2025, Hunters International had claimed over 285 victims worldwide before announcing their shutdown in July 2025.

Hunters International operates as a decentralized RaaS collective using dark-web infrastructure, Tor-based communication portals, and anonymized servers to obscure their physical location. While there is no officially confirmed headquarters, the group notably avoids targeting Russian organizations—a pattern consistent with Russian-speaking cybercriminal operations seeking to avoid scrutiny from Russian law enforcement. The group’s victims span approximately 30 countries globally, with the United States experiencing the highest number of attacks, followed by victims in Canada, the United Kingdom, Germany, France, Australia, Brazil, Japan, and New Zealand.

Hunters International typically infiltrates networks through phishing campaigns and social engineering tactics designed to trick employees into downloading malicious files. They also exploit vulnerabilities in Oracle WebLogic servers (particularly CVE-2020-14644) and leverage compromised Remote Desktop Protocol (RDP) access. Once inside, attackers deploy tools like China Chopper web shells, conduct reconnaissance using built-in Windows utilities (ipconfig, nltest, dsquery), and escalate privileges by manipulating Active Directory. They exfiltrate data to MEGA cloud storage using tools like Rclone or WinSCP, then deploy Rust-based ransomware that encrypts files with AES encryption secured by RSA keys, appending the .LOCKED extension. Before encryption, they disable security defenses, delete Volume Shadow Copies using vssadmin and wmic commands, and disable Data Execution Prevention to maximize damage.

The visible encryption phase of a Hunters International attack can be devastatingly fast—small networks may be locked down in under 10 minutes, mid-size environments in 1–2 hours, and large enterprises within 8 hours. However, the actual attack timeline is much longer. Attackers typically spend 4–21+ days inside the network undetected during the reconnaissance and data exfiltration phases. During this dwell time, they quietly steal credentials, map the network infrastructure, exfiltrate sensitive data to external cloud storage, disable backup systems and security tools, and position themselves for rapid, simultaneous encryption across all critical systems.

There is no official public list of Hunters International victims, but confirmed cases were historically published on the group’s own dark-web leak site before they announced their shutdown in July 2025. Security researchers, cyber threat intelligence (CTI) platforms, and ransomware tracking sites like Ransomware.live documented over 285 confirmed victims. Notable victims included Tata Technologies, the London branch of the Industrial and Commercial Bank of China (ICBC), Anderson Oil & Gas, and Barber Specialties. Security teams typically monitor dark-web leak portals, threat intelligence feeds, DFIR reports, and cybersecurity news outlets to stay updated on newly disclosed victims.

You can remove the Hunters International malware binaries from infected systems, but that does nothing to decrypt your files or guarantee the attack is fully contained. The group’s Rust-based ransomware uses AES encryption secured with RSA keys, and there is no public decryptor available (though the group claimed to offer free decryption keys when they announced their shutdown in July 2025). Because attackers often establish persistence through web shells, backdoors, and compromised credentials, proper recovery requires professional incident response, complete environment remediation, credential resets across all systems, and restoration from clean, uncompromised backups that were created before the initial breach.

Hunters International attackers infiltrate your network days or weeks before encryption, operating silently during reconnaissance and data exfiltration phases. They steal credentials, map your Active Directory environment, disable EDR tools and backup systems, and exfiltrate sensitive data to external cloud storage like MEGA. When the ransomware detonates, files across Windows and potentially Linux systems are rapidly encrypted with the .LOCKED extension, Volume Shadow Copies are wiped using vssadmin and wmic commands, and ransom notes titled “read me now!.txt” appear throughout your directories. Shortly after encryption, stolen data is threatened or published on the gang’s dark-web leak site to pressure victims into paying. The double-extortion model means even if you restore from backups, your sensitive data remains compromised and at risk of public exposure.

Ransomware is best prevented through layered defense-in-depth security: promptly patching critical vulnerabilities (especially in internet-facing systems like Oracle WebLogic and RDP), enforcing phishing-resistant multi-factor authentication (MFA) on all accounts, deploying EDR with behavioral detection capabilities and 24/7 SOC monitoring, implementing network segmentation to restrict lateral movement, hardening identity systems and limiting administrative privileges, securing email gateways with advanced threat protection, and protecting backups with immutability, air-gapping, and MFA-controlled access so attackers cannot tamper with recovery options. Regular security awareness training, phishing simulations, threat hunting exercises, and tabletop incident response drills further strengthen your defensive posture.

Here’s a ransomware prevention checklist to help your organization block, detect, and contain attacks before encryption:

Patch critical vulnerabilities within 48–72 hours, prioritizing internet-facing systems Enforce MFA on all accounts, especially VPN, RDP, and administrative access Deploy EDR on all endpoints with behavioral detection enabled
Centralize logs into SIEM with 24/7 monitoring and alerting Monitor for lateral movement, credential dumping, and shadow copy deletion Disable unused RDP ports and enforce VPN with MFA for remote access Apply network segmentation and implement zero-trust architecture Restrict administrative privileges using least-privilege principles Harden backup infrastructure with immutability and offline/air-gapped copies Secure cloud storage with MFA and monitor for unusual data exfiltration Run regular phishing simulations and security awareness training Conduct tabletop incident response exercises quarterly Maintain an incident response retainer with a trusted IR firm

In July 2025, Hunters International announced on their dark-web leak site that they were shutting down operations and offering free decryption keys to victims. However, security researchers remain skeptical about whether this represents a genuine shutdown or simply a rebranding effort. The group had previously announced a shutdown in November 2024 but continued operations afterward. In April 2025, researchers identified evidence that Hunters International was transitioning away from encryption-based ransomware toward a pure data theft and extortion model under a new name, “World Leaks.” Given the group’s history as a rebrand of the FBI-disrupted Hive ransomware operation, organizations should remain vigilant as the threat actors may simply re-emerge under a different identity while maintaining similar tactics and infrastructure.