World Leaks Ransomware Decryption & Data Recovery

World Leaks was announced by the Hunters International administrators on 1 January 2025. Six weeks earlier, on 17 November 2024, the same operators had declared the project closed, citing law-enforcement pressure and falling profits - then reversed course and relaunched under a brand built on data theft without encryption. The shift was publicly confirmed by Group-IB and others in April 2025, and on 3 July 2025 the Hunters International brand formally shut down and offered free decryptors to the companies it had hit. Hunters International had been active since late 2023; Group-IB assesses with moderate confidence that it was possibly a rebrand of the dismantled Hive operation, citing heavy code overlap - an assessment, not a confirmed fact.

World Leaks kept the affiliate model. The core team supplies the leak site, the negotiation portal and a purpose-built exfiltration tool; affiliates handle intrusion and collection. Public trackers record somewhere between 174 and 178 named organisations depending on the platform, most of them posted during 2026. Around half the victims are US-based (92 of the 174 listed on one tracker, about 53%), with the remainder spread across roughly 30 countries led by the UK, Brazil, Germany and Canada; sectors cluster in manufacturing, healthcare, professional services and technology. The better-known cases are Dell's Customer Solution Centers in July 2025 (1.3 TB claimed; Dell said the material was primarily synthetic, publicly available or test data), Nike in January 2026 (around 190,000 files and 1.4 TB claimed, with the entry later pulled from the leak site and Nike never confirming the claim) and Tata Electronics in June 2026, where the published directories reportedly covered Apple-related manufacturing documentation and the company confirmed an incident while saying operations were unaffected.

As of 11 September 2026 no new victims have been posted since 21 July 2026 and the leak site has shown zero uptime over a 30-day monitoring window, so this page records the lifecycle as dormant - our own reading of the tracking data, not a shutdown confirmed by any vendor or law-enforcement agency. Public information is limited: there is no encryptor to analyse and the toolchain has never been fully documented. For extortion-only crews, silence usually means infrastructure rebuilding or another rebrand rather than an exit. No public report shows targeted operations against mainland China organisations; exposure for Chinese groups sits mainly with overseas subsidiaries, cross-border branches and upstream suppliers.

The defining trait is the absence of traits. Extensions are unchanged, documents still open, no ransom note is dropped, wallpaper is untouched and production keeps running. Most victims do not discover the intrusion themselves - they are named on the leak site, notified by a third party, or emailed directly by the operators.

On the leak-site side. A .onion address beginning with worldleaks publishes the organisation name, a claimed data volume, a countdown and sample packs, plus the entry point to a per-victim negotiation portal.

On hosts and the network - the more reliable early signals. The appliance item below comes from one public investigation whose timing overlapped with a posting on this leak site; it is not a signature unique to this brand:

• Anomalies on perimeter appliances, especially end-of-life SonicWall SMA 100 series. A non-empty (and immutable-flagged) /etc/ld.so.preload and a file such as libsamba-errors.so.6 posing as a system library are hallmarks of the OVERSTEP userland rootkit documented by Mandiant.
• Administrator or service accounts authenticating to the VPN from unfamiliar addresses outside working hours.
• Bulk sequential reads and archive creation across file servers, ERP and database hosts.
• Large outbound transfers to unfamiliar VPS, cloud storage or anonymous file-sharing endpoints.

Bottom line. If you do see a new extension and a ransom note, World Leaks can essentially be ruled out and the family should be re-identified from samples.

World Leaks runs on affiliates, so entry tradecraft varies. One chain is documented in far more detail than the rest, but its link to this brand needs stating plainly first:

• End-of-life perimeter appliances. UNC6148, tracked by Google Threat Intelligence (Mandiant), targeted EOL SonicWall SMA 100 series devices, pulling temp.db and persist.db to harvest administrator credentials together with OTP seeds. The OVERSTEP userland rootkit followed, surviving reboots by rewriting /etc/rc.d/rc.fwboot and the boot image, hooking open/readdir/write to hide itself and using sed to strip log evidence. Mandiant could not establish the initial access vector: candidates listed include the CVE-2024-38475 path traversal plus CVE-2021-20038/20035/20039 and CVE-2025-32819, and the report also assesses with moderate confidence that an undisclosed remote code execution flaw may have been used. The campaign ran from October 2024 into mid-2025. On the link itself: an organisation targeted in May 2025 was posted to the World Leaks leak site in June 2025, but Mandiant states it cannot rule out coincidental overlap - so this affiliate should not be treated as the group's only or primary entry route.
• Valid credentials, including OTP. Stolen OTP seeds mean one-time passwords can be replayed, so a password reset alone does not close the door.
• Lateral movement and data discovery. With legitimate credentials inside the network, operators map file servers, ERP and databases, then stage archives.
• Automated exfiltration. The core team supplies affiliates with a purpose-built exfiltration tool, marketed as fully undetectable and supporting - but not requiring - proxy connections, filling the same role as Hunters International's Storage Software.

The point worth stressing: nowhere in this chain is there an encryptor or a detonation moment, so nothing ever forces the business to notice.

This family does not encrypt. World Leaks deploys no encryptor. Nothing is renamed, shadow copies are not deleted, database services are not stopped and ESXi datastores are not touched. The damage lands on confidentiality, not availability.

Two consequences follow, and both drive the response:

• Detection is harder. In conventional ransomware, "nothing opens" is a forced alarm. Pure exfiltration provides no such moment, dwell time stretches accordingly, and many organisations learn of the breach on the day they are named.
• "Recovering the data" solves nothing. The data is still local, still intact, and backups are untouched - but a copy sits with the operators. The objective is not restoration; it is to establish what left, cut off access that may still work, and meet notification obligations.

Publicly verifiable detail on the exfiltration tool is thin: built from scratch by the core team, marketed to affiliates as fully undetectable, capable of proxied connections, and designed to automate bulk transfer. No public reverse-engineering report covers its protocol or on-disk artefacts, so do not expect a single IOC to settle attribution - lean on network telemetry and file-access auditing instead.

Its predecessor, Hunters International, was an encrypting family. If your case involves renamed files, work it under that entry.