Hunters International Ransomware Decryption & Data Recovery

Hunters International first appeared in the wild in mid-October 2023: Group-IB dates the first disclosure on its leak site to 13 October 2023, and public trackers place the start of the brand in the same part of that month. The crew claimed it had bought Hive's infrastructure and ransom binary and had "fixed the bugs in Hive that prevented file decryption in some cases". Group-IB assesses with moderate confidence that the group is possibly a Hive rebrand, citing heavy code overlap and underground forum posts that refer to it in Russian simply as "хайв" (Hive). Trend Micro tracks the actor as Water Ouroboros. The encryptor is written in Rust and ships for x86, x64 and ARM.

It ran as classic ransomware-as-a-service: the core team supplied the encryptor, the negotiation portal, the leak site and an exfiltration utility known as Storage Software, while affiliates handled intrusion and deployment. Microsoft-tracked Storm-0501 was one such affiliate, having deployed Hive, BlackCat, Hunters International, LockBit and Embargo in turn.

Over roughly two years the brand publicly claimed close to 300 attacks. Public trackers record 307 victim organisations across 53 countries, about 150 of them in the United States, 16 in the United Kingdom and 15 in Canada. Trend Micro's breakdown puts construction, IT, manufacturing and healthcare at the top, while public trackers rank professional services, manufacturing and technology first; either way the victims skew towards small and mid-sized organisations. Higher-profile cases include Fred Hutch Cancer Center (hundreds of thousands of patient records, with extortion emails sent directly to patients), Integris Health, US Navy shipbuilder Austal USA, Japanese optics maker Hoya, AutoCanada and Tata Technologies.

The lifecycle is closed. On 17 November 2024 the group first signalled it was winding down, citing falling profitability and rising government scrutiny. On 1 January 2025 it launched World Leaks, a pure data-extortion brand with no encryption at all. Group-IB documented the transition in April 2025, and on 3 July 2025 the operators formally announced the closure of the Hunters International project. World Leaks kept posting victims into mid-2026 - public trackers list roughly 170 organisations under that brand, with its last public posting on 21 July 2026. For enterprises today the family matters in two ways: legacy .locked data that still needs a recovery assessment, and the fact that its intrusion playbook - poisoned installers of sysadmin tools, and going straight for ESXi - is still in wide use by other crews.

The trap with this family is that it changed its entire signature in August 2024.

v1-v5 (October 2023 - August 2024)

• Extension: .locked appended to the full original filename (vendor reports usually render it .LOCKED), so report.xlsx becomes report.xlsx.locked. The base name is neither rewritten nor randomised.
• Ransom note: Contact Us.txt dropped in affected directories, in English, claiming both encryption and data theft, and supplying a victim ID plus a Tor negotiation portal.
• Leak site: the organisation's name appears on the Hunters International DLS with a sample data pack, confirming exfiltration.

v6 onwards (from 14 August 2024) The encryptor stopped appending extensions and stopped dropping ransom notes entirely - a deliberate stealth choice intended to keep ordinary staff unaware of the breach and to keep the communication channel in the attackers' hands. Identification then rests on:

• Files that still open by type but contain garbage, with sizes essentially unchanged and icons and extensions intact.
• A region of the file header left intact: per Group-IB the encryptor writes a fixed marker at offsets 0x45-0x58 to flag files it has already processed, and ciphertext starts at offset 0x59, so magic numbers and Office or PDF headers generally survive - "the file type is recognised but the file will not open" is the classic symptom.
• No note at all; instead the operators phone, email or message executives directly using OSINT-gathered contact details.
• Host-side traces: shadow copies wiped, database and backup agent services stopped, and a long list of business processes force-killed.

ESXi cases. Virtual machines are shut down in bulk via vim-cmd, and vmx, vmdk, vmss and nvram files under /vmfs/volumes are rewritten. Encrypted files carry a marker at offset 52 consisting of four random bytes plus a 17-byte constant, with 640 bytes of RSA-encrypted metadata appended at the end, and the free space of the datastore is filled with random data.

Bottom line. The .locked extension alone is not enough to attribute the family - several unrelated strains have used it - so the note structure, file trailer markers and sample characteristics must be assessed together. Equally, the absence of a changed extension and of any note does not rule this family out.

The defining access pattern for Hunters International and its affiliates was poisoning the IT administrators themselves rather than ordinary staff - going straight for the people holding privileged credentials:

• Search ads and SEO poisoning delivering trojanised sysadmin tools. In August 2024 the group distributed a digitally signed fake installer, ipscan-3.9.1-setup.exe, from sites impersonating Angry IP Scanner (and earlier Advanced IP Scanner), dropping the SharpRhino C# backdoor used for privilege escalation and PowerShell execution. In 2025 affiliates used malvertising to push a trojanised installer for RVTools, a VMware management utility, steering administrators to a fake download page that delivered the SMOKEDHAM PowerShell backdoor.
• Abuse of legitimate monitoring software. Once inside, Kickidler employee-monitoring software was deployed to capture an administrator's keystrokes and browsing, harvesting cloud backup and hypervisor credentials without tripping detection.
• Exploitation of internet-facing applications. Trend Micro observed exploitation of known Oracle WebLogic flaws (CVE-2019-2725, CVE-2017-10271, CVE-2019-2729), while affiliate Storm-0501 leaned on Zoho ManageEngine (CVE-2022-47966), Citrix NetScaler (CVE-2023-4966) and ColdFusion 2016, alongside heavy use of credentials bought from access brokers.
• Lateral movement and deployment. Kitty for reverse SSH tunnelling, WinSCP for exfiltration and payload delivery, Total Commander to browse and archive network shares, and VMware PowerCLI to drive ESXi hosts and run the encryptor across them; AdFind for domain reconnaissance, ProcessHacker and PCHunter to disable endpoint protection.
• Exfiltration. A bespoke Storage Software utility handled bulk data theft; it was later upgraded into the dedicated exfiltration tool used by World Leaks.

The practical lesson is blunt: the first domino is usually an engineer downloading a plausible-looking tool from the top of a search results page. Controlling where admin tooling comes from, allow-listing applications on administrator workstations and restricting network reachability of ESXi management interfaces pays far better than adding another endpoint agent afterwards.

Windows / generic encryptor. Written in Rust, file content is encrypted with AES using a randomly generated 128-bit key per file, driving the CPU's AES instruction extensions (AESKEYGENASSIST, AESIMC, AESENC, AESENCLAST) for speed. Each symmetric key is wrapped with an embedded RSA public key and stored alongside the file; the private key never touches the victim network, so there is no mathematical way back without it.

File layout. A region of the header is not overwritten: per Group-IB the encryptor checks and writes a fixed marker at offsets 0x45-0x58 to tell whether a file has already been processed, and ciphertext begins at offset 0x59. That detail matters forensically: magic numbers survive, so file type detection still works even though the content is unusable, and the surviving header retains some value for structural repair.

ESXi encryptor. Virtual machines are shut down in bulk via vim-cmd, then /vmfs/volumes is walked and vmx, vmdk, vmss and nvram files encrypted. Synacktiv's analysis of one incident shows this variant uses AES-256 CTR and encrypts only part of each file - roughly the first 10% of the data after the marker (capped at about 100 MiB) plus a further limited amount - with 640 bytes of RSA-encrypted metadata appended and a marker at offset 52 made of four random bytes plus a 17-byte constant. It then writes a temporary file that fills the datastore's remaining free space with random data, a deliberate anti-forensics step that severely limits what can later be carved from unallocated space. That description comes from a single vendor's single case, so whether it holds for every ESXi build has to be measured per incident.

Recovery inhibition. The encryptor carries a default list of dozens of processes and services to terminate (Group-IB's published list runs to roughly fifty entries: database engines, backup agents, Office, browsers and more), tunable via -k/--kill and -s/--skip. Several commands clear shadow copies and backup catalogs, including vssadmin.exe delete shadows /all /quiet, and the build can wipe free disk space. Other switches - -w/--wait to delay execution, -l/--low-key for a quiet run that skips process termination and disk partition mounting, -R/--no-remote to disable remote host enumeration, -E/--no-erase to skip wiping, -a/--admin to impersonate a domain administrator - mean the amount of collateral damage varies widely between incidents and must be measured case by case rather than assumed.

Double extortion. The operators openly prioritised data theft over encryption: files were exfiltrated with Storage Software before the encryptor ran, non-payment led to staged publication on the leak site, and in some cases extortion emails were sent directly to the victim's patients or customers. That preference eventually became World Leaks, which dropped encryption altogether.