Hunters International Threat Actor Profile: Tactics, Data Extortion and Defences

Hunters International told its own affiliates that encryption was not the main goal: the operation was built to steal data first, and by 2025 it had dropped encryption altogether. This profile draws on Group-IB's analysis of the operation's encryptor and affiliate panel, Quorum Cyber's incident response findings on the SharpRhino remote access trojan, reporting by BleepingComputer and The Record, and MITRE ATT&CK v20. It covers names and lineage, targeting, techniques mapped to ATT&CK, how affiliates abuse IT staff and domain administrator credentials, the main public events, and the detections and controls that matter most when the threat is theft rather than lock-out. No US or UK government advisory dedicated to Hunters International has been published at the time of writing, so findings rest on named vendor research. It is written for security operations, identity and incident response teams; it contains no leak-site material and names no individuals.

Key takeaways

• A likely Hive successor. Group-IB assesses with moderate confidence that Hunters International is a rebrand of Hive, the operation law enforcement infiltrated and shut down in 2023; the group says it bought Hive's source code.
• Exfiltration was the business model. The operators described data theft as the main objective, supplied affiliates with a "Storage Software" tool to index stolen files over Tor, and launched the extortion-only World Leaks on 1 January 2025.
• IT staff were deliberately targeted. Quorum Cyber found the SharpRhino RAT delivered from a typosquatted Angry IP Scanner site, a lure aimed at administrators whose accounts carry the privileges affiliates need.
• Domain admin credentials drive the encryption stage. The encryptor has an option to run as a domain administrator to reach remote shares, and it covers Windows, Linux, FreeBSD, SunOS and ESXi.
• Quiet files are not safe files. From version 6 the encryptor renames nothing and drops no note, so detection must come from behaviour (shadow copy deletion, service stops, Tor egress), not from file extensions.

Who they are (names and aliases)

Hunters International was a ransomware-as-a-service operation. MITRE ATT&CK v20 has no group or software entry for it, so the techniques below come from vendor reporting mapped to ATT&CK rather than from an ATT&CK group page. Group-IB dates the start to October 2023: the first leak-site disclosure on 13 October, a Windows sample submitted to VirusTotal on 19 October and the first affiliate panel rules note on 21 October.

The group announced a closure on 17 November 2024, citing falling profitability and government scrutiny, but kept operating; on 3 July 2025 The Record reported a second closure announcement with an offer of free decryptors to past victims, which incident responders regarded as poorly built. Treat World Leaks as the same threat for planning purposes. See the Ransomware Groups Guide for how rebrands are tracked across the ecosystem.

Targeting and motivation

• Motivation: financial, through double extortion and later pure data extortion (ATT&CK T1657 Financial Theft). The affiliate panel advertised an 80 per cent share of ransom payments to affiliates.
• Scale: BleepingComputer, reporting Group-IB, puts claimed attacks at more than 280 worldwide between late 2023 and April 2025, with demands from hundreds of thousands to millions of US dollars. These are the group's claims; The Record notes it is unclear how many victims were actually encrypted.
• Sectors: Group-IB lists real estate, healthcare and professional services, with healthcare and critical infrastructure highlighted as a 2024 trend.
• Geography: North America, Europe and Asia. The group claimed to avoid Israel, Turkey, the Far East and CIS countries, yet its disclosures included companies in China, Turkey, Singapore and Japan, so stated exclusions should not be relied on.
• Pressure tactics: Group-IB describes a mailing feature for contacting a victim's partners, clients and competitors, and third-party research into executives and their relatives for phone, email and social media pressure. See the Data Extortion Without Encryption Guide.

Tactics and techniques (MITRE ATT&CK)

Group-IB maps the encryptor and Storage Software to ATT&CK; Quorum Cyber and BleepingComputer describe SharpRhino. Group-IB's original mapping used an Impair Defenses sub-technique that ATT&CK v20 has revoked; the equivalent v20 technique T1685 is shown. All IDs were checked against ATT&CK v20.

How they abuse identities and credentials

Human administrators

• Targeting the people with the keys: fake network scanner downloads are aimed at IT staff. BleepingComputer notes the lure suggests an intent to reach privileged accounts. An administrator who browses and downloads tools from the same account and workstation used for domain administration hands that privilege to the RAT. See the Malvertising and SEO Poisoning Guide and the Typosquatting and Lookalike Domains Guide.
• Privilege escalation on the endpoint: Quorum Cyber reports SharpRhino used previously unseen techniques to obtain high privileges with little disruption. Local administrator rights for daily-use accounts shorten that step.
• Executive pressure: research into executives and their families turns personal identity data into leverage. See the Executive Protection and Digital Footprint Guide.

Privileged and non-human accounts

• Domain administrator as a deployment mechanism: the encryptor is designed to be launched with domain admin credentials to reach shares across the estate. A domain admin account usable from any server is a mass-deployment credential. See the Tiered Administration and Enterprise Access Model Guide.
• Hypervisor administration: ESXi hosts are a target, and changing boot settings needs root. Domain-joined hosts and shared root passwords widen the blast radius. See the ESXi Ransomware Playbook.
• Backup service credentials: deleting backup catalogues requires backup system rights; keep backup identities out of the production domain. See the Backup Identity Isolation Guide.

Notable incidents

Victims below are those named in the reporting cited; claims by the group are labelled as such and no leak-site material was used.

Detection and defence

Phased response for a defender

1. Control where admin tools come from: publish an approved catalogue of network and admin utilities, block unapproved installers with application control (start in audit mode for two weeks, review blocks, then enforce with a documented exception route), and filter newly registered and lookalike domains.
2. Separate admin identities: give administrators separate privileged accounts used only from privileged access workstations without web browsing; deny domain admin logons to member servers and workstations through user rights assignment.
3. Constrain PowerShell: enable script block logging (Event 4104), use Constrained Language Mode under application control for standard users, and alert on PowerShell compiling C# in memory.
4. Watch the exit: block Tor at the egress and alert on SOCKS or bulk outbound transfers from file servers; data theft is the primary harm, so egress detection matters more here than with encryption-led groups.
5. Protect recovery: immutable or offline backups under separate credentials, ESXi lockdown mode and execInstalledOnly enforced, and quarterly restore tests.
6. Rehearse extortion response: run a tabletop for theft without encryption, including contact with clients, partners and executives' families, legal notification and the payment decision. See the Ransomware Response and Recovery Guide.

What to log and alert on

Metrics that show it is working

• Unapproved installer executions: count blocked or flagged by application control each week, trending down.
• Admin separation: percentage of administrators with a separate privileged account used only from privileged access workstations.
• Tier 0 exposure: number of domain admin logons outside tier 0 assets per month; target zero.
• Exfiltration detection time: minutes from a simulated bulk transfer to an analyst alert.
• Restore success: share of quarterly restore tests met within the recovery time objective.

Decision guidance

Small organisations should prioritise removing local admin from daily accounts, a separate admin account with MFA, managed detection that covers endpoint and firewall telemetry, and an offline backup copy. Larger estates should implement tiered administration, privileged access workstations and egress analytics on file servers, and should plan for data extortion as the default outcome rather than encryption. Paying for deletion of stolen data does not prove deletion; see the Ransomware Payments and Sanctions Guide before any decision.

Framework mapping

Practitioner checklist

• Publish an approved admin tool catalogue and block other installers with application control.
• Give administrators separate privileged accounts used only from privileged access workstations.
• Deny domain admin logons outside tier 0 and alert on Events 4624 and 4672 for those accounts.
• Enable PowerShell script block logging and alert on in-memory C# compilation.
• Block Tor egress and alert on bulk outbound transfers from file servers.
• Alert on shadow copy deletion, backup catalogue deletion and bcdedit recovery changes.
• Enforce ESXi lockdown mode and execInstalledOnly, and isolate hypervisor and backup credentials.
• Rehearse a data extortion scenario with no encryption, including third-party contact.

Standards and references

• Group-IB: Hunters International ransomware group analysis
• Quorum Cyber: SharpRhino, new Hunters International RAT
• MITRE ATT&CK: Inhibit System Recovery (T1490)
• MITRE ATT&CK: Automated Exfiltration (T1020)
• NIST: SP 800-53 Rev. 5
• BleepingComputer: Hunters International rebrands as World Leaks in shift to data extortion
• BleepingComputer: Hunters International targets IT workers with SharpRhino malware
• The Record: Hunters International extortion group claims shutdown

Related NHI Mgmt Group resources: Ransomware Groups Guide · Threat Actor Groups Guide · Data Extortion Without Encryption Guide · ALPHV BlackCat Threat Actor Profile · Ransomware Prevention Guide