Hunters International Ransomware Gang Shuts Down and Offers Free Decryption Keys to All Victims

TL;DR

The Hunters International ransomware gang has announced its shutdown, citing recent developments. They are offering free decryption keys to all affected organizations, acknowledging the impact of their activities. This move may be a strategic rebranding to evade law enforcement.

Hunters International Ransomware Gang Announces Shutdown

In a surprising turn of events, the notorious ransomware group Hunters International has announced its shutdown. The group cited unspecified “recent developments” as the reason behind this decision. This announcement was made on their dark web site, acknowledging the significant impact their activities have had on various organizations.

Official Statement from Hunters International

The group released an official statement on their Tor leak site:

“We, at Hunters International, wish to inform you of a significant decision regarding our operations. After careful consideration and in light of recent developments, we have decided to close the Hunters International project. This decision was not made lightly, and we recognize the impact it has on the organizations we have interacted with.”

They further stated:

“As a gesture of goodwill and to assist those affected by our previous activities, we are offering free decryption software to all companies that have been impacted by our ransomware. Our goal is to ensure that you can recover your encrypted data without the burden of paying ransoms. We understand the challenges that ransomware attacks pose, and we hope that this initiative will help you regain access to your critical information swiftly and efficiently. To access the decryption tools and receive guidance on the recovery process, please visit our official website.”

Impact and Victims

The ransomware gang has offered free decryption keys to all victims, allowing them to recover their data without paying any ransom. Victims are urged to visit the group’s site for the decryption keys, although no specific information is currently available. Over the past two years, Hunters International has claimed nearly 300 victims, including high-profile targets such as Tata Technologies and the Fred Hutchinson Cancer Center.

Emergence and Suspected Links

Hunters International emerged in the threat landscape after international authorities seized the infrastructure of the Hive gang. Experts suspect that Hunters International is a rebrand of the Hive ransomware gang, as they have been observed using a code similar to that of the Hive gang¹.

Potential Rebranding to World Leaks

There is speculation among experts that Hunters International’s shutdown may be a strategic move to rebrand as a new group called World Leaks. This rebranding could be an attempt to distance themselves from their old infrastructure, which poses risks of being tracked by law enforcement. World Leaks is suspected to involve the same threat actors, although they are using new ransomware and infrastructure².

Conclusion

The shutdown of Hunters International and their offer of free decryption keys mark a significant development in the ongoing battle against ransomware. While this move may provide relief to affected organizations, it also raises questions about the group’s future activities and the potential for rebranding to evade law enforcement. Stay tuned for more updates on this evolving story.

Additional Resources

For further insights, check:

• Security Affairs
• The Record

References

1. “French authorities arrest Hive ransomware member” (2025). Security Affairs. ↩︎

2. “Hunters International ransomware extortion group claims shutdown” (2025). The Record. ↩︎