Loading malware…
World Leaks is an affiliate-based cyber extortion operation that emerged as a rebrand of Hunters International and is widely associated with the broader shift from traditional ransomware toward exfiltration-led extortion. The group has promoted an encryption-less model centered on data theft, leak-site pressure, and victim negotiation, and it provides affiliates with proprietary data exfiltration tooling as part of an extortion-as-a-service offering. Its operations have targeted organizations across multiple sectors, including manufacturing, healthcare, and technology, with a concentration of known victims in North America and additional activity in Europe.
World Leaks commonly gains access through compromised remote-access infrastructure and valid credentials, including VPN access without multi-factor authentication, and has also been linked to phishing, exposed public-facing applications, and remote desktop services. After access, operators and affiliates use living-off-the-land and administrative tooling for internal movement and remote execution, including SMB, RDP, SSH, PsExec, and WinRM, alongside reconnaissance and account abuse. Reported tradecraft also includes persistence through scheduled tasks and account manipulation, use of cloud tunneling for command-and-control, and large-scale data theft to cloud storage services using both custom tooling and common exfiltration utilities.
Although World Leaks has been presented as an extortion-only operation that deemphasizes encryption, reporting has documented at least one healthcare-sector intrusion in which attackers both exfiltrated data and deployed ransomware, indicating that affiliates may conduct mixed-mode operations combining stealthy theft with file encryption. The group has been described as maintaining leak-site infrastructure, negotiation portals, affiliate management capabilities, and media-facing mechanisms intended to amplify coercive pressure on victims. World Leaks is therefore best understood as an extortion-focused successor to Hunters International that primarily emphasizes data theft and public exposure, while retaining the capacity for conventional ransomware behavior in some intrusions.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
World Leaks emerged in early 2024 as a direct rebrand of the Hunters International ransomware group... In January 2026, Darktrace identified the presence of ransomware and data encryption linked to World Leaks within the network of an organization within the healthcare sector.
8 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An extortion-focused ransomware brand exemplifying encryption-less, data theft-only operations where leverage comes from publication rather than file encryption.
An emerging or returning ransomware group identified in Halcyon’s Q2 2026 reporting.
Affiliate-based extortion operation that evolved from Hunters International. It primarily focuses on data theft, exfiltration, leak-site extortion, and negotiation infrastructure, though the report also documents a 2026 incident where it encrypted victim data using a ransomware payload.
Ransomware/extortion brand associated with double-extortion activity impacting multiple industrial verticals.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.