The Hunters International ransomware gang has officially shut down its operations and announced it will provide free decryption tools to all previous victims, marking a rare retreat in the cybercrime world.
In a statement posted Thursday on its dark web portal, the gang cited “recent developments” for its closure, stating, “This decision was not made lightly, and we recognize the impact it has on the organizations we have interacted with.” The group is now offering free recovery assistance, allowing victims to decrypt their data without paying ransoms.
The announcement follows a prior warning in November 2024, when Hunters International hinted at a shutdown due to growing law enforcement pressure and declining profits. Cybersecurity firm Group-IB later revealed the group had rebranded as World Leaks, shifting from encryption-based attacks to data theft and extortion-only operations using custom-built exfiltration tools.
Hunters International, active since late 2023 and believed to be a rebrand of the infamous Hive ransomware group, claimed nearly 300 global attacks. High-profile victims included the U.S. Marshals Service, Fred Hutch Cancer Center, Hoya, AutoCanada, and Integris Health.
Victims of past attacks can now request decryption tools and support through the gang’s dark website, as all extortion data has been removed.
