Description Summary
World Leaks emerged in January 2025 as a rebrand of the Hunters International ransomware operation, shifting its focus from file encryption to solely stealing sensitive data and threatening to leak it unless a ransom is paid.
Threat Actor
Rebrand of Hunters International; automated exfiltration tool; 'Insider' portal gives media 24h early access to leaks.
Technical Indicators
Encryption Extension
N/A — no encryption (pure data extortion)
Encryption Algorithm
N/A — data theft only
Ransom Note Name
N/A
Targeted Industries
Cross-sector (per leak-site victim telemetry)
First Seen
1 January 2025 (rebrand of Hunters International)
Last Seen
Active (150+ victims)
Geographical Location
Global / not publicly profiled
MITRE ATT&CK Matrix
| Tactic | TTP | Technique Name |
|---|---|---|
| Impact x 2 | T1486 | Data Encrypted for Impact |
| T1490 | Inhibit System Recovery | |
| Exfiltration x 1 | T1567 | Exfiltration Over Web Service (leak site) |
| Initial Access x 2 | T1190 | Exploit Public-Facing Application |
| T1078 | Valid Accounts |