A prolific ransomware group says it’s shutting down and giving out free decryption keys to victims – but cyber experts warn it's not exactly a 'gesture of goodwill'
The Hunters International ransomware group is rebranding and switching tactics
The notorious Hunters International ransomware group has announced it’s shutting down and is offering a parting gift for its victims.
"After careful consideration and in light of recent developments, we have decided to close the Hunters International project,” the group said in a post on its dark web page.
The statement noted that the "decision was not made lightly", while the hackers behind the group recognized the impact attacks have had on victim organizations in recent years.
As part of its reconciliation efforts, the group said it plans to give free decryptor keys to anyone that had been hit by is ransomware.
“Our goal is to ensure that you can recover your encrypted data without the burden of paying ransoms," they said.
Hunters International is going through a rebrand
Hunters International emerged two years ago and has since carried out a range of attacks, targeting a US cancer center and Tata Technologies. The group claimed to have breached the US Marshals Service, although this was denied by the law enforcement agency.
The group's decision was signposted back in April, when it said that ransomware had become 'unpromising, low-converting, and extremely risky'.
But organizations shouldn't rest too easy, according to Dray Agha, senior manager of security operations at Huntress. Indeed, the group is essentially rebranding under a new name and will adopt new tactics moving forward.
"While Hunters International frames their shutdown as a ‘gesture of goodwill,’ this is likely a strategic rebrand - not repentance - as they have morphed into the group ‘World Leaks’, an extortion-only operation," Agha said.
World Leaks operates on an extortion-only model, with data held to ransom without file encryption. It emerged earlier this year as a side project from Hunters International and operates four platforms.
These include a main data leak site, a negotiation site for ransom payments, an insider platform for journalists and media, and an affiliate panel for cyber criminals.
The move to focus entirely on World Leaks isn't surprising, said Daniel dos Santos, senior director and head of research at Forescout.
He noted that ransomware groups often rebrand and it was already known that Hunters was operating in data exfiltration under the World Leaks name. Crucially, what this does suggest is that the cyber criminals behind the operation are becoming increasingly wary of law enforcement crackdowns.
"Their move from data encryption to pure data exfiltration is more interesting, as it confirms that ransomware gangs are well aware that law enforcement activity against ransomware is likely to increase, with the fight against these gangs ‘moving from the virtual to the real plane’ in their own words,” he said.
“This could be good news for healthcare operators, manufacturing companies, retailers, and others that often had to stop operations in the past half decade."
Santos warned that victims shouldn't be too optimistic when it comes to getting their hands on their free decryptor.
"Our recent analysis of ransomware negotiations has shown that even when victims pay for decryptors, these tools often do not work, and cybercriminals offer little in terms of ‘customer support'," he said. "I don’t expect that a freely released decryptor would work 100% of the time.”
Make sure to follow ITPro on Google News to keep tabs on all our latest news, analysis, and reviews.
MORE FROM ITPRO
- A major ransomware hosting provider just got hit US with sanctions
- The new ransomware groups worrying security researchers in 2025
- Ransomware victims are getting better at haggling with hackers
-
Post-cloud strategy: the cloud bill shockIn-depth Rising cloud costs, sovereignty concerns, and AI workloads are forcing enterprises to rethink hyperscale dependence
-
NTT Data to acquire WinWire in enterprise AI services pushNews The deal will expand the firm's Microsoft practice and AI capabilities with an additional 1,000 Azure engineers and specialists
-
Instructure chose to a pay ransom following the Canvas cyber attack – research shows more than half of security leaders would follow suitAnalysis Opting to pay ransoms creates huge risks for enterprises – you’re relying on the word of criminals
-
Ransomware negotiator sentenced for role in major cyber crime groupNews Deniss Zolotarjovs was a key player in a group associated with Conti
-
Threat actors ditch ‘spray and pray’ attacks in shift to targeted exploitationNews A dip in ransomware volumes points to a more targeted approach focused on vulnerability exploitation
-
Security leaders overconfident about ransomware recoveryNews Few manage to recover all their data, and many experience business disruption
-
German authorities want your help finding the hackers behind GandCrab and REvilNews Daniil Maksimovich Shchukin and Anatoly Sergeevitsch Kravchuk are believed to have made millions from ransomware as a service schemes
-
The rise of teen hackers ‘makes for a good headline’, but cyber crime activities peak later in life
News With family responsibilities and mortgages to pay, it's not teenagers dishing out malware or carrying out cyber extortion
-
Using AI to generate passwords is a terrible idea, experts warnNews Researchers have warned the use of AI-generated passwords puts users and businesses at risk
-
Researchers called on LastPass, Dashlane, and Bitwarden to up defenses after severe flaws put 60 million users at risk – here’s how each company respondedNews Analysts at ETH Zurich called for cryptographic standard improvements after a host of password managers were found lacking
