[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f4fgpc_yWxsVRn1tzIeeyvaXHK_wylLIiN1jE8QwRKnQ":3,"$fpSfCZYHHZPaez0-DWebfPe-IXaP_0seWKa81Bf-HJns":71},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":15,"hero_image_url":16,"structured":17,"story_type":68,"created_at":69,"updated_at":70,"published_at":23},"hunters-international-ceases-operations-announces-mass-leak-of-stolen-data-from-","Hunters International Ceases Operations, Announces Mass Leak of Stolen Data from 67 Victims","The ransomware group declared its shutdown days before the SatanLock exit, marking a significant contraction in the extortion ecosystem.","Hunters International has officially closed its project and announced it will leak stolen data from 67 victims, following a period of increased law enforcement pressure that led to its rebranding as World Leaks earlier this year.",[10,11,12,13,14],"Ransomware","Data Extortion","Hunters International","World Leaks","Cybercrime","# Hunters International Ceases Operations, Announces Mass Leak of Stolen Data from 67 Victims\n\n*The ransomware group declared its shutdown days before the SatanLock exit, marking a significant contraction in the extortion ecosystem.*\n\n**Tags:** `Ransomware` `Data Extortion` `Hunters International` `World Leaks` `Cybercrime`\n\n> Hunters International has officially closed its project and announced it will leak stolen data from 67 victims, following a period of increased law enforcement pressure that led to its rebranding as World Leaks earlier this year.\n\n---\n\n## SatanLock Ceases Operations and Announces Mass Data Leak\n\nThe SatanLock ransomware group has officially declared the end of its operations, marking a sudden exit from the cybercrime ecosystem. In a public shutdown announcement, the group stated it will leak all stolen data from 67 victims who did not pay ransoms or negotiate successfully. This abrupt cessation follows a broader trend in the industry where groups are shutting down due to increased law enforcement pressure and declining profitability.\n\n## The Scale of the Data Exposure\n\nThe data release encompasses material from 67 distinct victims, representing a substantial volume of sensitive information exposed in a single event. While the affected organizations span multiple industries, specific sector breakdowns for this particular batch were not detailed in the immediate announcement. This mass publication functions as a final extortion tactic, effectively serving as a 'burning of bridges' move before the group disappears from public view.\n\n## Context: A Wave of Ransomware Group Exits\n\nSatanLock’s abrupt cessation follows closely on the heels of Hunters International, which also declared its closure just days prior. This sequence underscores a broader pattern within the ransomware sector, where multiple groups are simultaneously withdrawing from active operations. Hunters International, originally established as a file-encryption group in late 2023, had previously rebranded to World Leaks in January 2025, pivoting its strategy entirely toward data extortion and abandoning encryption tactics.\n\nIn its final public statement, the group cited \"recent developments\" and acknowledged that the decision was not made lightly. The organization recognized the impact of its closure on the entities it had targeted, which included high-profile victims such as Nike, Dell, and UBS. Unlike SatanLock’s approach of mass-leaking stolen data from unpaid victims, Hunters International provided free decryption keys to affected organizations upon exiting. This divergence in exit strategies highlights differing operational motivations within the cybercrime ecosystem, with some groups opting for punitive data exposure while others choose a more conciliatory departure.\n\n## Implications for Victims and the Industry\n\nThe immediate publication of data from 67 organizations creates an urgent crisis for affected entities, exposing them to significant risks of privacy violations, financial fraud, and lasting reputational harm. Unlike traditional ransomware incidents where encryption is the primary threat, this mass leak prioritizes the exposure of sensitive secrets, meaning that standard backup and recovery protocols offer no protection against the dissemination of stolen information. Security teams must now pivot their focus from restoring system availability to managing the fallout of exposed credentials and proprietary data, a shift that fundamentally alters the defensive calculus for organizations facing pure data extortion tactics.\n\nThis event also highlights a notable divergence in how ransomware groups are exiting the ecosystem. While SatanLock has chosen to liquidate its stolen assets through punitive mass leaks, Hunters International opted for a more conciliatory departure by providing free decryption keys to its victims. This contrast underscores a broader shift in operational dynamics, where some actors prioritize final extortionary impact over long-term campaign sustainability, while others seek to mitigate victim damage as they withdraw from active operations.\n\n## Key points\n\n- Hunters International issued a public statement confirming the closure of its project, citing recent developments and the impact on organizations it has interacted with.\n- The group announced a mass leak of stolen data from 67 victims as part of its shutdown process.\n- This exit occurs just days after the SatanLock ransomware group also ceased operations and leaked files from 67 victims, indicating shifting dynamics within the ransomware ecosystem.\n- Hunters International previously rebranded to World Leaks in January 2025, abandoning file encryption for pure data extortion after citing that ransomware had become too risky and unprofitable due to law enforcement pressure.\n\n## Further reading & sources\n\n- [SatanLock Ransomware Group Abruptly Shuts Down, Leaks All Stolen Files - Security Spotlight](https:\u002F\u002Fdailysecurityreview.com\u002Fsecurity-spotlight\u002Fsatanlock-ransomware-group-abruptly-shuts-down-leaks-all-stolen-files)\n- [FBI disrupts the Dispossessor ransomware operation, seizes servers](https:\u002F\u002Fbleepingcomputer.com\u002Fnews\u002Fsecurity\u002Ffbi-disrupts-the-dispossessor-ransomware-operation-seizes-servers)\n- [Ransomware.live: worldleaks](https:\u002F\u002Fransomware.live\u002Fgroup\u002Fworldleaks)\n- [Who is WorldLeaks? The Ransomware Group Behind Nike Breach](https:\u002F\u002Fblog.cyberdesserts.com\u002Fworldleaks-ransomware-group)\n- [WorldLeaks group breached the City of Los Angels](https:\u002F\u002Fsecurityaffairs.com\u002F189753\u002Fdata-breach\u002Fworldleaks-group-breached-the-city-of-los-angels.html)\n- [Black Nevas · RansomLook](https:\u002F\u002Fransomlook.io\u002Fgroup\u002Fblack%20nevas)\n- [U-Bomb Ransomware: In-Depth Analysis, Detection, and Mitigation](https:\u002F\u002Fsentinelone.com\u002Fanthology\u002Fu-bomb)\n- [Fletchen Stealer: An Information Stealer with Sophisticated Anti-Analysis Measures - CYFIRMA](https:\u002F\u002Fcyfirma.com\u002Fresearch\u002Ffletchen-stealer-an-information-stealer-with-sophisticated-anti-analysis-measures)\n- [Ransomware.live: fletchen](https:\u002F\u002Fransomware.live\u002Fgroup\u002Ffletchen)\n- [Ransomware in 2026: Same Business, New Rules | Group-IB Blog](https:\u002F\u002Fwww.group-ib.com\u002Fblog\u002Fransomware-2026-rules)\n- [Brace Before The Impact: 7 Signals Your Organization Needs A Cybersecurity Services Retainer | Group-IB Blog](https:\u002F\u002Fwww.group-ib.com\u002Fblog\u002Fcyber-retainer-signals)\n- [Ransomware Tool Matrix Project Updates: May 2025](https:\u002F\u002Fblog.bushidotoken.net\u002F2025\u002F05\u002Fransomware-tool-matrix-project-updates.html)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fhunters-international-ceases-operations-announces-mass-leak-of-stolen-data-from-.png?v=30e371dd2f",{"actors":18,"malware":38,"targets":47,"timeline":55,"industries":64},[19,25,28,32,35],{"url":20,"name":21,"slug":21,"type":22,"origin":23,"motivation":24},"\u002Fthreat-groups\u002Fu-bomb","u-bomb","ransomware",null,"financial",{"url":26,"name":12,"slug":27,"type":22,"origin":23,"motivation":24},"\u002Fthreat-groups\u002Fhunters-international","hunters-international",{"url":29,"name":30,"slug":31,"type":22,"origin":23,"motivation":23},"\u002Fthreat-groups\u002Fsatanlock","Satanlock","satanlock",{"url":33,"name":13,"slug":34,"type":22,"origin":23,"motivation":24},"\u002Fthreat-groups\u002Fworld-leaks","world-leaks",{"url":36,"name":37,"slug":37,"type":22,"origin":23,"motivation":23},"\u002Fthreat-groups\u002Fdispossessor","dispossessor",[39,41,43,45],{"name":40},"U-Bomb Ransomware",{"name":42},"SatanLock",{"name":44},"WorldLeaks",{"name":46},"Dispossessor Ransomware",[48,52],{"name":49,"sector":50,"status":51,"geography":23},"Nike","Retail\u002FFashion","confirmed",{"name":53,"sector":54,"status":51,"geography":23},"UBS","Financial Services",[56,60],{"date":57,"event":58,"description":59},"2025-04","Emergence","SatanLock emerged and built a reputation through aggressive extortion tactics.",{"date":61,"event":62,"description":63},"2025-07-08","Shutdown announcement","SatanLock announced its shutdown and planned leak of all stolen files.",[65],{"url":66,"name":54,"slug":67},"\u002Findustries\u002Ffinancial-services","financial-services","ransomware_incident","2026-08-18T18:39:28.135907+00:00","2026-10-16T12:29:25.15731+00:00",{"articles":72},[73,84,95,106],{"slug":74,"title":75,"summary":76,"tags":77,"hero_image_url":82,"story_type":68,"created_at":83},"stormencryptor-ransomware-deployed-via-n-central-auth-bypass-cve-2026-18577","StormEncryptor ransomware deployed via N-central auth-bypass CVE-2026-18577","A former Medusa affiliate (Storm-1175) is actively deploying StormEncryptor ransomware through an incomplete patch for CVE-2026-18556 in N-able N-central, allowing unauthenticated remote attackers to bypass authentication and take over the RMM server to reach managed endpoints.",[78,79,80,10,81],"N-able N-central","CVE-2026-18577","StormEncryptor","MSP","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fstormencryptor-ransomware-deployed-via-n-central-auth-bypass-cve-2026-18577.png?v=80dc7c8067","2026-09-24T07:05:56.501709+00:00",{"slug":85,"title":86,"summary":87,"tags":88,"hero_image_url":93,"story_type":68,"created_at":94},"dragonforce-ransomware-hits-saudi-chemical-manufacturer","DragonForce Ransomware Hits Saudi Chemical Manufacturer","The DragonForce ransomware group has claimed a Saudi Arabian chemical manufacturer, adding to its Q2 2026 run of 144 victims and its ongoing campaign against Gulf-region industrial targets.",[89,10,90,91,92],"DragonForce","Saudi Arabia","Chemical Manufacturing","ASEC","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fdragonforce-ransomware-hits-saudi-chemical-manufacturer.png?v=789ad783bf","2026-09-19T12:09:53.129912+00:00",{"slug":96,"title":97,"summary":98,"tags":99,"hero_image_url":104,"story_type":68,"created_at":105},"qilin-ransomware-tops-june-2026-with-83-cases-41-manufacturing-hits-92-us-victim","Qilin Ransomware Tops June 2026 with 83 Cases, 41 Manufacturing Hits, 92 US Victims","AhnLab ASEC's June 2026 Ransomware Trend Report shows Qilin as the most active group with 83 cases, 41 manufacturing incidents, and 92 US hits, while also targeting Musashino University, ISUZU Motors, and the Central Bank of Libya.",[100,10,101,102,103],"Qilin","AhnLab ASEC","Manufacturing","US","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fqilin-ransomware-tops-june-2026-with-83-cases-41-manufacturing-hits-92-us-victim.png?v=b915ec283d","2026-09-18T07:07:39.952851+00:00",{"slug":107,"title":108,"summary":109,"tags":110,"hero_image_url":115,"story_type":68,"created_at":116},"interlock-ransomware-exploits-cisco-fmc-zero-day-for-unauthenticated-root-rce","Interlock Ransomware Exploits Cisco FMC Zero-Day for Unauthenticated Root RCE","Interlock ransomware is actively exploiting a critical Cisco FMC zero-day (CVE-2026-20131) that allows unauthenticated remote attackers to execute arbitrary Java code as root, with double extortion and custom tooling.",[111,112,113,10,114],"Interlock","Cisco FMC","CVE-2026-20131","Zero-Day","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Finterlock-ransomware-exploits-cisco-fmc-zero-day-for-unauthenticated-root-rce.png?v=092737b648","2026-08-31T07:05:12.614729+00:00"]