huntersMalware
- Hunters International
Emerging in Q3 2023 as a Ransomware-as-a-Service (RaaS) operation, Hunters International has established itself as a distinct yet controversial threat actor in the cybercrime ecosystem. While initial analysis revealed a code overlap with the dismantled Hive ransomware, the group claims independence, asserting it purchased Hive’s source code rather than directly rebranding.From MISP Galaxy
Last reported 3 months ago, by Group-IB4 reports
ATT&CK techniques
6 of 23 · each with the sentence it comes from- T1003.001LSASS Memory
“…ames and passwords and also usernames and password hashes (T1550.002) which are usually retrieved by threat actors through LSASS Dump (T1003.001) during the intrusions.”
- T1020Automated Exfiltration
“Automated Exfiltration (T1020)”
- T1021.002SMB/Windows Admin Shares
“Remote Services: SMB/Windows Admin Shares (T1021.002)”
- T1027Obfuscated Files or Information
“Obfuscated Files or Information: Software Packing (T1027.002 )”
- T1027.002Software Packing
“Obfuscated Files or Information: Software Packing (T1027.002 )”
- T1027.008Stripped Payloads
“Obfuscated Files or Information: Stripped Payloads (T1027.008)”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
4 reports, newest first · the exact sentence from each-
Ransomware in 2026: Same Business, New Rules“Hunters International formalized this by rebranding as World Leaks and providing affiliates with an exfiltration-only tool.”
-
Brace Before The Impact: 7 Signals Your Organization Needs A Cybersecurity Services Retainer“Ransomware groups like Hunters International, Qilin don’t abandon environments after a first intrusion.”
-
Ransomware debris: an analysis of the RansomHub operation“…d ransomware usually focus on Windows and ESXi hypervisor, we observed some ransomware groups such as Apos, RTM, Lynx, Qilin and Hunters International providing ransomware which supports ARM, MIPS, PowerPC, RISC and other architectures as well as FreeBSD operating system.”
-
The beginning of the end: the story of Hunters International“The beginning of the end: the story of Hunters International”
Indicators in its reports
named in the reports above- operations[.]inin 1 report
- 45.8.228[.]240in 1 report
- huntersinternational[.]suin 1 report
- 45.135.233[.]154in 1 report
- lynxblog[.]netin 1 report
- incblog[.]suin 1 report
- huntersinternational[.]bondin 1 report
- huntersinternational[.]ltdin 1 report
- huntersinternational[.]topin 1 report
- huntersinternational[.]vipin 1 report
- 193.106.175[.]48in 1 report
- huntersinternational[.]orgin 1 report
- 185.185.68[.]40in 1 report
- 109.172.85[.]126in 1 report
- 185.185.69[.]129in 1 report
- 185.12.127[.]116in 1 report
- 158.160.141[.]169in 1 report
- 192.185.35[.]253in 1 report
- 185.244.181[.]173in 1 report
- huntersinternational[.]netin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.