The cybercrime syndicate known as Hunters International officially announced the termination of its operations this Thursday via a post on its dark web portal. The group, which has been active for two years, cited “recent developments” as the primary driver for the decision, though it failed to provide specific details regarding the nature of these changes.
Free Decryption Keys Offered to Victims
In a surprising move, the hackers claimed they are providing free decryption keys to all organizations previously targeted by their ransomware campaigns. The group stated that its objective is to allow victims to recover encrypted data without the necessity of paying ransoms. However, as of this writing, no such decryption tools are currently available on the group’s official website.
A History of High-Profile Attacks
Throughout its two-year tenure, Hunters International has been linked to several high-profile security breaches. Notable incidents include an attack on a U.S. cancer center. Additionally, the group previously claimed responsibility for stealing sensitive documents from the U.S. Marshals Service, an assertion that the federal law enforcement agency formally denied.
Rebranding or Evasion Tactics?
Industry experts remain skeptical about the gang’s sudden altruism. Allan Liska, a threat intelligence analyst at Recorded Future, suggests the shutdown may be a strategic “cutting of ties” with aging infrastructure. According to Liska, signs of a transition to a new group known as “World Leaks” have been visible since April.
The Motivation Behind the Exit
The shift to a new entity, which utilizes different ransomware software and distinct hosting infrastructure, is a common tactic among cybercriminals. Experts point to several potential reasons for this behavior:
- Infrastructure Obsolescence: Using the same technical foundation for extended periods increases vulnerability to law enforcement tracking.
- Pressure from Authorities: The group may have received intelligence that investigators were closing in, prompting a preemptive shutdown.
- Financial Strategy: Releasing decryption keys for older victims costs the group nothing, as the window for profitable extortion has likely already closed.
While the transition to World Leaks is under investigation, Liska notes that the individuals operating the new platform may be the same actors behind the now-defunct Hunters International. History shows that ransomware gangs frequently dissolve only to re-emerge under new branding to evade sanctions and confuse cybersecurity researchers.