Hunters Ditches Ransomware

Summary

Hunters International, a ransomware-as-a-service (RaaS) operation, is shifting from ransomware attacks to pure data extortion. This move comes as the group rebrands to “World Leaks,” focusing on data theft and leveraging the threat of public exposure to extort victims. This shift reflects a broader trend in the cybercrime landscape, where data extortion is becoming increasingly prevalent.

Explore the data solution with built-in protection against ransomware TrueNAS.

** Main Story**

Hunters International Shifts to Data Extortion: The Rise of World Leaks

Hunters International, a prominent RaaS operation, has announced its transition from ransomware attacks to a purely data extortion model under the new name “World Leaks.” This strategic shift, effective January 1, 2025, marks a significant change in the group’s operations and reflects a broader trend in the cybercrime landscape. The move comes after Hunters International claimed over 280 attacks against organizations worldwide, impacting various sectors and demanding ransoms ranging from hundreds of thousands to millions of dollars. Notable victims include Tata Technologies, AutoCanada, the U.S. Marshals Service, Hoya, Austal USA, and Integris Health.

The Reasons Behind the Shift

Hunters International cites declining profitability and increased government scrutiny as the primary drivers for this change. The group’s administrator stated that ransomware is “no longer profitable and risky.” This sentiment echoes a growing concern among ransomware operators facing increased pressure from law enforcement and cybersecurity professionals. The rise of international collaborations targeting ransomware groups, along with the development of decryptors and the seizure of criminal infrastructure, has made traditional ransomware operations more challenging and less lucrative. Furthermore, increased public awareness and efforts to discourage ransom payments have further impacted the profitability of ransomware attacks.

World Leaks: A New Era of Data Extortion

World Leaks operates as an extortion-only group, utilizing a custom-built exfiltration tool, an upgraded version of the Storage Software previously used by Hunters International affiliates. This tool enables the group to efficiently exfiltrate sensitive data from victims’ networks and leverage it for financial gain. Unlike the double extortion tactic employed by Hunters International, where data was both encrypted and stolen, World Leaks focuses solely on data theft and the threat of its public release. This tactic allows the group to bypass the challenges posed by decryption efforts and focus on maximizing the impact of data exposure on victims. The stolen information is then used to extort victims who want to prevent the release of their sensitive information to public or competitors.

Hunters International’s Evolution

Hunters International emerged in late 2023, initially raising suspicions of being a rebrand of the Hive ransomware group due to code similarities. The group denied these claims, stating that they had purchased Hive’s source code. Hunters International ransomware targeted a wide range of platforms, including Windows, Linux, FreeBSD, SunOS, and ESXi, supporting x64, x86, and ARM architectures. This cross-platform capability allowed the group to target diverse systems and maximize its reach. The group’s initial operations involved a double extortion model, encrypting victim data and threatening to leak it if ransom demands were not met. However, this approach evolved over time, with data exfiltration becoming increasingly prioritized.

The Future of Ransomware and Data Extortion

The shift by Hunters International to a pure data extortion model highlights a growing trend within the cybercrime ecosystem. As traditional ransomware attacks become more challenging and less profitable, cybercriminals increasingly turn to data extortion as a primary tactic. This trend suggests that data protection and security measures must evolve to address the increasing sophistication and prevalence of data exfiltration techniques. Organizations need to prioritize data loss prevention strategies, implement robust security controls, and develop comprehensive incident response plans to mitigate the risks associated with data extortion attacks. The evolution of Hunters International serves as a stark reminder of the ever-changing nature of cyber threats and the need for continuous adaptation and vigilance in the face of evolving criminal tactics.