Hunters International Shuts Down Ransomware Operations: What CISOs Need to Know About the Shift to Extortion-Only Attacks

It’s rare to hear “good news” in the world of ransomware, but the recent announcement from the notorious Hunters International gang has sent shockwaves—and a hint of hope—through the cybersecurity community. The group claims it’s shutting down ransomware operations, offering free decryption keys to victims, and pivoting (or rebranding) toward data theft and extortion-only attacks under a new name: World Leaks.

But before you breathe a sigh of relief, there’s a catch. Seasoned threat researchers and CISOs alike are rightfully skeptical. Is this a genuine olive branch, a cunning PR move, or simply standard operating procedure for cybercriminals looking to shake law enforcement and reappear elsewhere? And what, exactly, does this mean for organizations still reeling from recent attacks—or trying to stay one step ahead of the next?

Let’s break down what’s happening, why it matters to your security strategy, and how to protect your organization in this rapidly evolving threat landscape.

The Sudden Shutdown of Hunters International: Real Relief or Rebranding Ruse?

If you’re responsible for defending your organization’s data, you’ve likely tracked the meteoric rise of Hunters International since late 2023. The group made a name for itself with aggressive double extortion tactics—encrypting files and threatening to leak stolen data unless ransoms were paid. But now, seemingly overnight, the “brand” is gone.

According to a statement posted by Hunters International, the decision to shutter ransomware operations was “not made lightly” and comes with a gesture of goodwill: free decryption tools for all affected companies. On the surface, this sounds like a rare win for victims desperate to recover scrambled files without forking over millions.

However, as industry experts cautioned, cybercriminals aren’t typically known for altruism. Luke Connolly, a threat analyst at Emsisoft, told CSO Online, “Whether their offer [of free decryption keys] is true or not is anyone’s guess at this point. Keep in mind that they are criminals, and ransomware groups are notorious for making false claims in support of their own objectives.”

Here’s why that matters: A sudden shutdown often signals a strategic move—either to evade law enforcement, duck financial pressures, or simply rebrand and return under a new name. In Hunters International’s case, the trail leads directly to “World Leaks,” a group now touting itself as an extortion-only collective.

From Ransomware to Data Extortion: A Growing Cybercrime Trend

Let’s make sense of this shift. Traditionally, ransomware gangs have followed a two-pronged approach:

Encrypt victim files so companies can’t access critical data.
Exfiltrate and threaten to leak sensitive information unless a ransom is paid.

Hunters International excelled at both. But now, their successor (World Leaks) and other groups are focusing exclusively on the second tactic: data theft and extortion. This “extortion-only” approach is gaining traction for several reasons:

Stealthier Attacks: Without noisy file encryption, extortionists can fly under the radar, avoiding many conventional defenses and detection tools.
Regulatory Pressure: With governments cracking down on ransom payments and international agencies arresting key ransomware actors, encryption-based attacks are riskier.
Financial Calculus: Some threat groups find data leaks alone are profitable enough, especially when targeting organizations with sensitive regulatory, financial, or personal information.

Singapore-based cybersecurity firm Group-IB reports that World Leaks has already claimed 31 victims since its inception—without deploying ransomware once.

In short: The threat is evolving, not disappearing.

Should You Trust “Free Decryptors” from Criminals?

Hunters International’s offer sounds tempting, but is it too good to be true? If you’re a CISO or IT director facing encrypted files, you might wonder: should I take the risk?

Here’s what to consider:

1. Potential Risks of Using Decryptors from Criminal Sources

Malware Risks: Downloading and running tools from a criminal website is inherently dangerous. There’s a real chance the decryptor could contain additional malware or backdoors.
No Guarantees: Previous ransomware groups have offered decryption keys only to later withdraw the offer, provide incomplete tools, or simply disappear.
Legal and Chain-of-Custody Concerns: Engaging with criminal infrastructure—even for “helpful” tools—can have legal ramifications and complicate forensic investigations.

2. Expert Recommendations

Ryan Chapman, a SANS Institute instructor, urges caution: “Decryption tool releases such as this have happened in the past, and are one of the primary reasons we at SANS recommend that ransomware victims back up their most critical encrypted data—you never know when you might be able to decrypt the data in the future.”

If you’re considering using a decryptor:

Conduct malware analysis and reverse engineering in an isolated, sandboxed environment.
Never run untrusted tools in production or on networked machines.
Back up all encrypted data before any attempts at decryption.

Why Did Hunters International Really Shut Down? The Bigger Picture

The sudden closure of one of the most notorious ransomware brands isn’t happening in a vacuum. Several converging pressures are forcing cybercriminal groups to change tactics or go underground.

Key Drivers Behind Ransomware Group Shutdowns:

Law Enforcement Action: Recent global crackdowns—like the arrests of LockBit members, the dismantling of the Radar/Dispossesor gang, and Operation Endgame’s takedown of hundreds of malware servers—have made high-profile ransomware operations riskier.
Payment Restrictions: Governments are increasingly forbidding or strictly regulating ransom payments, removing the financial incentive for cybercriminals.
Affiliate Fallout: When a ransomware group “shuts down,” affiliates (the freelance hackers who infect victims and split the ransom) often get left out in the cold—souring the business model.
Brand Burnout: Groups like Hunters International have rebranded before, possibly evolving from the notorious Hive gang. Rebranding helps them dodge law enforcement and reputation blacklists.

As KnowBe4 security advocate Erich Kron puts it: “Odds are at least some of these folks are going to splinter off to other groups, or may have created their own already, so organizations can’t exactly rest any easier.”

The Hunters International Playbook: Who Was at Risk?

Hunters International didn’t emerge from nowhere. According to Group-IB, the gang surfaced around October 2023 claiming to have purchased the source code of Hive ransomware and “fixed its flaws.” Their targets included:

Real Estate Firms
Healthcare Organizations
Professional Services

Notably, the group claimed to prohibit attacks on Israel, Turkey, the Far East, and countries in the Russia-aligned Commonwealth of Independent States (CIS). Yet, data leaks from these regions suggest those rules were loosely enforced at best—a reminder that criminal “codes of conduct” are often marketing, not policy.

Since their debut, Hunters International listed nearly 300 victims on their data leak site—proof that even upstart ransomware-as-a-service (RaaS) groups can have a devastating impact in a short time.

What CISOs and IT Teams Should Do Now: Minimizing the Risk

With ransomware groups rapidly pivoting to extortion-only attacks, here’s how organizations should respond:

1. Assume Data Theft Is the Primary Threat

Even as ransomware recedes, data exfiltration is the name of the game. This means:

Encrypt sensitive data at rest and in transit.
Segment and monitor your networks to detect unusual outbound activity.
Review access controls: Limit “need-to-know” access and monitor privileged account use.

2. Prepare for Double and Triple Extortion

Today’s cybercriminals may:

Threaten to release data publicly.
Contact your customers, partners, or regulators directly to maximize pressure.
Launch follow-on attacks, like DDoS or harassment campaigns.

Have a playbook for incident communications and legal reporting. Practice tabletop exercises with your executive team.

3. Don’t Rely on Ransomware-Only Defenses

Traditional ransomware defenses (like backup and restoration) are still critical—but not enough.

Invest in Endpoint Detection and Response (EDR) solutions that can spot credential theft and lateral movement.
Use Data Loss Prevention (DLP) tools to monitor for unauthorized exfiltration.
Harden email security—many attacks still start with phishing.

4. Stay Updated on Threat Intelligence

Track rebranding efforts and new group names via trusted sources such as:

Proactive intelligence helps you anticipate tactics before they hit your door.

5. Foster Human Risk Management

Social engineering remains a favorite weapon—even for newly minted “extortion-only” gangs. Training employees to spot phishing, suspicious requests, and social engineering is as crucial as any technical control.

Are We Really Safer? Why Organizations Can’t Let Their Guard Down

It’s tempting to view the shutdown of a big-name threat actor as a turning point. But history—and threat intelligence—tells a different story.

When ransomware groups “shut down,” they often:

Rebrand under a new name.
Sell or recycle their malware and infrastructure.
Splinter into smaller, harder-to-track cells.

As Sophos senior threat researcher Aiden Sinnott explains, “Despite their claim to shut down the Hunters International group, we believe it is likely that they have rebranded as World Leaks, a new group that does not deploy ransomware, but has conducted data theft and extortion attacks since January.”

In other words: The threat persists—just in different packaging.

Key Takeaways: How to Respond to the Evolving Ransomware-Extortion Landscape

The fall of Hunters International is a case study in cybercrime adaptation. While one door closes (ransomware encryption), another opens wider: extortion-only attacks that rely on data exfiltration and the threat of public exposure.

Here’s what every CISO, IT leader, and security-aware business should do next:

Don’t get complacent: The shutdown of one group is likely just a pivot, not a win.
Verify, don’t trust, “free” decryptors: Use isolated environments and backup data before attempting any recovery.
Prioritize data governance and network visibility: You can’t protect what you can’t see or control.
Double down on employee training: Humans remain the best and weakest link.
Stay informed: Cybercrime evolves rapidly—so must your defenses.

If you’re facing a ransomware or extortion incident, consult with trusted cybersecurity partners and legal counsel before making any moves. And remember: resilience comes from preparation, not luck.

Frequently Asked Questions (FAQ)

1. Is it safe to use Hunters International’s free decryption tool?

Not by default. Downloading and using decryption tools from criminal sources carries significant risks, including malware infection and further compromise. Always analyze such tools in an isolated, secure environment first—and consult cybersecurity professionals before proceeding.

2. What is an “extortion-only” attack?

An extortion-only attack involves stealing sensitive data from an organization and threatening to release it publicly unless a ransom is paid. Unlike traditional ransomware, these attacks do not encrypt files, making them harder to detect early on.

3. Has Hunters International really become World Leaks?

While there is strong evidence and expert consensus that Hunters International has rebranded as World Leaks, some researchers urge caution in making a definitive link. What’s clear is that the tactics have shifted from encryption to pure data extortion.

4. How can organizations defend against extortion-only attacks?

Key strategies include: – Encrypting sensitive data – Monitoring for unauthorized data transfers – Limiting access privileges – Training staff to spot phishing and social engineering – Regularly updating and patching systems

5. Are ransomware attacks declining?

While traditional ransomware with file encryption may be facing more challenges due to law enforcement and payment restrictions, cybercriminals are not going away—they’re simply changing tactics, with extortion-only attacks on the rise.

6. Should I pay the ransom in an extortion-only attack?

Law enforcement agencies and cybersecurity experts generally advise against paying, as it funds cybercrime and offers no guarantees. Consult with authorities and legal counsel for guidance specific to your situation.

Stay vigilant, stay informed, and remember—cybersecurity is a journey, not a destination. If you found this analysis helpful, consider subscribing for more expert updates on evolving cyber threats and practical defenses. Your organization’s resilience depends on what you do next.

For further insights and detailed threat intelligence, visit Group-IB’s blog, The Hacker News, and CISA’s ransomware guidance.

Discover more at InnoVirtuoso.com

I would love some feedback on my writing so if you have any, please don’t hesitate to leave a comment around here or in any platforms that is convenient for you.

For more on tech and other topics, explore InnoVirtuoso.com anytime. Subscribe to my newsletter and join our growing community—we’ll create something magical together. I promise, it’ll never be boring!

Stay updated with the latest news—subscribe to our newsletter today!

Thank you all—wishing you an amazing day ahead!

Hunters International Shuts Down Ransomware Operations: What CISOs Need to Know About the Shift to Extortion-Only Attacks

The Sudden Shutdown of Hunters International: Real Relief or Rebranding Ruse?

From Ransomware to Data Extortion: A Growing Cybercrime Trend

Should You Trust “Free Decryptors” from Criminals?