Hunters International, a ransomware-as-a-Service (RaaS) outfit, shut down operations and will provide free decryptors to victims seeking to restore their data without paying a ransom.
"After careful consideration and in light of recent developments, we have decided to close the Hunters International project. This decision was not made lightly, and we recognize the impact it has on the organizations we have interacted with," the ransomware outfit notes in a statement published on its dark web.
"As a gesture of goodwill and to assist those affected by our previous activities, we are offering free decryption software to all companies that have been impacted by our ransomware. Our goal is to ensure that you can recover your encrypted data without the burden of paying ransoms.”
The attackers also erased all entries from the extortion platform and stated that firms whose systems were encrypted in Hunters International ransomware assaults can access decryption tools and recovery guidance from the gang's official website.
While the ransomware group does not specify what "recent developments" it alludes to, the latest development follows a November 17 statement stating that Hunters International will soon cease operations due to growing law enforcement scrutiny and diminishing profitability.
In April, threat intelligence firm Group-IB also disclosed that Hunters International had started a new extortion-only operation dubbed "World Leaks" and was rebranding with plans to zero in on data theft and extortion-only attacks.
Group-IB stated at the time that "World Leaks operates as an extortion-only group using a custom-built exfiltration tool, in contrast to Hunters International, which combined encryption with extortion." The new tool seems to be an improved version of the Storage Software exfiltration tool that Hunters International's ransomware affiliates used.
Due to code similarities, security researchers and ransomware specialists identified Hunters International, which surfaced in late 2023, as a potential rebranding of Hive. The malware from the ransomware group supports x64, x86, and ARM architectures and targets a variety of platforms, including Windows, Linux, FreeBSD, SunOS, and ESXi (VMware servers).
Hunters International has attacked businesses of all sizes over the last two years, demanding ransoms ranging from hundreds of thousands to millions of dollars, depending on the size of the compromised organisation. The ransomware group has claimed credit for around 300 attacks worldwide, making it one of the most active ransomware campaigns in recent years.
The ransomware outfit has claimed several notable victims, including the United States Marshals Service, the Japanese optical firm Hoya, Tata Technologies, the North American car dealership AutoCanada, the United States Navy contractor Austal USA, and Integris Health, Oklahoma's largest non-profit healthcare network.