World Leaks

World Leaks is a cyber extortion and ransomware group that emerged in 2025 as a rebrand or spin-off of Hunters International, which itself has been widely linked to code and operational lineage from Hive. Reporting consistently characterizes World Leaks as shifting emphasis away from traditional encryption-centric ransomware toward data theft and encryption-less extortion, while still being referred to in many cases as a ransomware operation and maintaining a leak site for coercion. The group has claimed numerous victims globally and has been particularly visible in attacks against organizations in the United States and India. Reported victims and targeting include healthcare providers, manufacturers, educational institutions, and contractors tied to critical infrastructure projects. Publicly discussed incidents include claims involving Operation PAR and Centers Laboratory in the United States, as well as data theft and publication activity affecting Reliance Infrastructure and files associated with India’s Kudankulam Nuclear Power Plant project. Additional reporting notes victim claims involving Tata Electronics, Tata Group, and Nike. World Leaks is associated with large-scale data exfiltration, leak-site publication, and ransom demands backed by threats of public disclosure. In multiple cases, the group publicly posted stolen files after deadlines expired, consistent with data-theft extortion. Some reporting describes the operation as an emerging model of encryption-less extortion that lowers the barrier to conducting industrial-sector attacks. At the same time, victim reporting and incident summaries also continue to label some World Leaks intrusions as ransomware attacks, indicating the brand spans both classic ransomware and theft-first extortion activity. Tradecraft attributed through its Hunters International lineage includes initial access via malvertising and trojanized software installers, use of remote access trojans and persistence mechanisms, credential collection and surveillance, reverse SSH tunneling, RDP-enabled lateral movement, disabling security tooling prior to impact, and use of utilities for staging and exfiltration. Hunters International reporting also links the lineage to custom ESXi ransomware deployment, DLL sideloading, and VMware-focused post-exploitation. Separate reporting associates World Leaks with an in-house exfiltration tool referred to as RustyRocket. The group operates a data leak site and has been described as capable of hosting and publishing large stolen datasets. World Leaks is best understood as a financially motivated extortion operation in the contemporary ransomware ecosystem, notable for its rebranding from Hunters International and its strong emphasis on exfiltration-led coercion.