Ransomware: Hunters International to abandon data encryption

Cybercriminals are likely to change their identity and focus on extortion.

On April 2, 2025, cybersecurity company GroupIB published an in-depth analysis of the history and activities of the Russian-speaking ransomware gang Hunters International. The report includes extensive technical details about the tools and protocols used by the cybercriminal group. It also reveals that Hunters International is likely nearing its end as an entity.

According to the report, the gang’s operators are planning to “shut down the project” and rebrand as “World Leaks,” shifting their focus entirely to extortion and dropping data encryption altogether. GroupIB notes that Hunters International has always prioritized data theft over encrypting machines.

The first cyberattack claimed by Hunters International dates back to October 2023. Shortly after, cybersecurity researchers noticed similarities between this new ransomware and Hive, the notorious gang that was dismantled just a few months earlier.

Hunters International’s administrator has denied any connection to Hive, stating they only purchased Hive’s ransomware source code. Nevertheless, many Russian-speaking cybercriminal actors continue to refer to Hunters International as “Hive.” Today, GroupIB assesses with “moderate confidence” that a lineage between the two gangs likely exists.