Hunters

Inactive
In mid-October 2023, just a few days before the Europol operation, the source code of the Ransomware Hive was sold, along with its website and older versions developed in Golang and C (although this purchase has only been reported by the actors without concrete evidence). The buyer of this new source code was the group Hunters International, who claimed to have fixed the bugs in the Ransomware Hive that were responsible for preventing file decryption in some cases. The group also stated that file encryption would not be their primary focus; instead, they would use data theft as a method to pressure victims during extortion attempts.
307 Victims
Sep 9, 2021 First Discovered
May 27, 2025 Last Discovered
477 Days Inactive
0% Infostealer
0/4 Sites Online
Known Locations (4)
HUNTERS INTERNATIONAL
hunters55rdxciehoqzwv7vgyv6nt37tbwax2reroyzxhou7my5ejyid.onion
HUNTERS INTERNATIONAL
hunters33mmcwww7ek7q5ndahul6nmzmrsumfs6aenicbqon6mxfiqyd.onion
HUNTERS INTERNATIONAL
hunters55atbdusuladzv7vzv6a423bkh6ksl2uftwrxyuarbzlfh7yd.onion
Attention Required! | Cloudflare
huntersinternational.org
Tools Used
DiscoveryEnum
Advanced IP Scanner, Advanced Port Scanner
Exfiltration
RClone, WinSCP
Intelligence
Victims (307)

Detailed victim list temporarily unavailable

This group has 307 victims. The victim list API is currently responding slowly for this dataset. Country, sector, and infostealer breakdowns are not available at this time. Basic stats (victim count, first/last seen) are shown above from a faster data source.