Hunters International Adds 2 New Victims to its Name
Hunters International announced 2 new victims on their leak website. These are the US-based Rocky Mountain Sales and the Australian SSS Australia. There’s no public statement from the victims yet.
- Hunters International is one of the most modern and competent ransomware gangs today
- The organization first came public in late October 2023, which makes it a new entry in the ransomware sphere
- Hunters International is known to rely on the double-extortion practice to coerce the victim into negotiating and, ultimately, pay the ransom
- Based on the gang’s attack history, Hunters International prefers to target high-value targets with meaty revenues
2023 has been a fruitful year for the ransomware business bubble as a whole. The number of attacks has increased dramatically compared to 2022, as has that of the paid ransoms. There are several potential explanations for this.
One of them links to the increase in the number of newcomers in the ransomware sphere. Hunters International is one of them. But that’s not the whole story.
The real story is that, despite it being new in the industry, Hunters International is already making waves. They’re hunting high-value targets primarily and showcase impressive success in terms of actually breaching their victims.
This paints the organization as highly competent, using modern tools and tactics, which is a bit atypical for any new player in the business. Fortunately, there’s a theory that could explain this anomaly and that’s the link between Hunters International and Hive.
Hive was one of the most competent, dangerous, and intimidating ransomware gangs in the world, pre-January, 2023, when the FBI cracked down on it. The organization was dissolved and its assets redistributed.
Hunters International self-admittedly bought some of them. According to the hackers themselves, Hunters International managed to acquire around 60% of Hive’s code.
Is Hunters International the New Hive?
Yes and no. While Hunters International does appear to have purchased some of Hive’s code, they don’t operate within the same bounds. Hunters International is a new, standalone group with its unique identity and protocol.
From a practical perspective, Hunters International is simply a scavenger, using the resources of a defunct organization like Hive to boost its own internal structure. This is typically what happens in the ransomware sphere whenever a group is dismantled.
So, how does the new ransomware actor operate? Hunters International relies on the double extortion practice to force the victims into paying. The hackers deploy the encryption tool, locking the victim’s files and downloading all the data they can get.
The victim then needs to bargain with them for the decryption tool, as well as the deletion of the stolen information. If no compromise is reached during negotiations, the hackers will expose the data publicly.
This can result in both reputational and financial losses for the victim.
However, as cybersecurity analysts point out, that usually happens even if the victim does pay the ransom. That’s because there’s no way for the victim to verify that the hackers have kept their word.
The conclusion is simple: don’t negotiate and don’t pay anything.
Our Mission
We believe security online security matters and its our mission to make it a safer place.
