Hunters World shifts from ransomware to pure records extortion
Private eye
The Hunters World Ransomware-as-a-Service (RaaS) operation is shutting down and rebranding with plans to exchange to records theft and extortion-entirely assaults.
As threat intelligence agency Neighborhood-IB revealed this week, the cybercrime community remained active despite pronouncing on November 17, 2024, that it modified into shutting down on account of declining profitability and elevated executive scrutiny.
Since then, Hunters World has launched a brand unique extortion-entirely operation acknowledged as “World Leaks” on January 1, 2025.
“From the administrator’s perspective, ransomware is no longer profitable and risky. The criminals collaborating with the group will be provided with a purportedly self-developed exfiltration tool designed to automate the process of data exfiltration in the victims’ networks,” Neighborhood-IB acknowledged on Wednesday.
“Unlike Hunters International, which combined encryption with extortion, World Leaks operates as an extortion-only group using a custom-built exfiltration tool.”
The unique instrument seems to be an upgraded variant of the Storage Utility exfiltration instrument that Hunters World’s ransomware affiliates also exhaust.
Login web page for World Leaks affiliates panel (Neighborhood-IB)
Hunters World surfaced in tiring 2023 and modified into flagged as a capability rebrand of Hive thanks to code similarities. Its ransomware targets a gargantuan replacement of platforms, including Dwelling windows, Linux, FreeBSD, SunOS, and ESXi (VMware servers), and it also helps x64, x86, and ARM architectures.
Since its emergence, this ransomware gang has claimed over 280 assaults against organizations worldwide, making it indubitably one of potentially the most active ransomware operations.
Hunters World also breached the Fred Hutch Cancer Center in December, threatening to leak the stolen records of over 800,000 most cancers patients within the event that they weren’t paid.
Thus a ways, Hunters World operators trust focused companies of all sizes. BleepingComputer has seen ransom demands starting from an whole bunch of thousands to millions of bucks, reckoning on the breached organization’s dimension.
