The notorious ransomware group Hunters International has announced its closure, offering free decryption keys to victims in a surprise move that experts believe could signal a strategic rebrand rather than a permanent exit.
On Thursday, the gang posted on its dark web site: “After careful consideration and in light of recent developments, we have decided to close the Hunters International project.”
The message did not specify which developments prompted the shutdown but acknowledged the impact of its operations on affected organizations.
The hackers added: “Our goal is to ensure that you can recover your encrypted data without the burden of paying ransoms,” directing victims to its official site to retrieve decryption keys.
However, checks revealed no such keys were publicly available at the time of writing.
Hunters International operated for approximately two years, claiming high-profile victims in Africa including an attack on Namibia’s state-owned telecom company and Kenya’s Urban Roads Authority.
The abrupt shutdown follows a pattern seen with previous ransomware groups, many of which released decryption keys before disappearing, only to resurface under new names or operations.
What’s Next for Hunters International?
According to Allan Liska, threat intelligence analyst at Recorded Future, signs of a rebrand to a group called World Leaks had been visible since April.
Speaking to Tech Crunch, Liska stated: “I think this is more of a ‘cutting of ties’ with the old infrastructure. As far as releasing decryption keys, at this point they aren’t likely to make any money from any Hunters’ victims who are still out there, so they probably see it as a gesture that doesn’t really cost them anything.”
The World Leaks group reportedly uses different ransomware software and hosts its operations on a separate site, but experts suggest the same individuals could be behind it.
Liska also noted that ransomware gangs often dismantle their infrastructure to avoid detection or imminent law enforcement action, citing the FBI takedown of the Hive ransomware gang in 2023.
While it remains unclear whether Hunters International has truly retired or is simply adopting a new identity, the move underscores the evolving tactics of ransomware groups seeking to evade authorities.
Source: Tech Crunch
About Author
