Hunters International abandons ransomware and focuses on data theft

On July 3, 2025, the ransomware gang Hunters International announced on the dark web that it would abandon ransomware activities and focus instead on data extortion. Likely an offshoot of the Russian gang Hive, this cybercriminal group, responsible for over 300 attacks worldwide, is shutting down the “Hunters International” entity.

The hackers even published the decryption keys for all their ransomware. They will now operate under the name “World Leaks” and focus on stealing data without encrypting IT systems.

This announcement comes at a difficult time for the Ransomware-as-a-Service ecosystem. Over the past two years, several international police operations have targeted leading ransomware groups. At the same time, larger organizations that are attacked have become more resilient and are less likely to pay the demanded ransoms.

Ransomware attacks are now increasingly targeting smaller, less prepared entities, especially SMEs. The gangs thus collect smaller ransoms, which may discourage some cybercriminals seeking significant profits.