Hunters International

Hunters International is a ransomware-as-a-service operation that emerged in late 2023 and is widely assessed to be a technical successor or rebrand of Hive, based on code overlap and shared tradecraft, although the operators have publicly claimed only to have acquired Hive assets. The group has targeted organizations across multiple sectors and geographies, including healthcare, government-related entities, construction, and industrial environments, and has been associated with both traditional file-encrypting ransomware attacks and data-theft extortion.

Hunters International has operated against Windows and VMware ESXi environments. Documented intrusions show affiliates obtaining initial access through malvertising that lured administrators to download trojanized software installers, as well as through exploitation of remote access weaknesses. In one well-documented intrusion, a malicious installer delivered the SMOKEDHAM backdoor via DLL sideloading, after which the attackers established persistence, monitored administrators for credential collection, created reverse SSH tunnels, moved laterally with RDP, exfiltrated archived data, and then deployed a custom Rust-based ESXi encryptor using VMware PowerCLI and SCP/SSH automation.

The ESXi ransomware variant is a stripped Rust ELF binary focused on VMware storage paths and virtual-machine-related file types. It can power off virtual machines before encryption, encrypt targeted files with AES-256 in CTR mode using per-file random material, append RSA-encrypted metadata, and optionally fill free disk space with random data to increase operational impact. Investigators also observed delayed execution controls during deployment, indicating deliberate coordination of encryption across multiple hosts.

Beyond encryption, Hunters International has been linked to double-extortion and, by late 2024, increasingly to exfiltration-first or exfiltration-only operations. The group has pressured victims through leak-site publication and, in at least one notable case, direct extortion of affected individuals whose data was allegedly stolen from a healthcare organization. Reporting also indicates that the operation later shifted toward the World Leaks brand, which has been assessed as a rebrand or spin-off emphasizing data extortion while retaining continuity with Hunters International’s ecosystem.

Hunters International has also been used by financially motivated affiliates such as Storm-0501, which has deployed multiple ransomware families over time. Overall, the operation is best characterized as a mature RaaS threat combining opportunistic initial access, hands-on-keyboard post-exploitation, data exfiltration, and cross-platform ransomware deployment, with particular capability against virtualized enterprise infrastructure.