Hunters International Cyberattackers Take Over Hive Ransomware

Hunters International appears to have acquired Hive ransomware from its original operators and may be seeking to cash in on the malwares reputation.

The FBI may have successfully disrupted the destructive Hive ransomware operation earlier this year, but the groups malware code continues to present a threat to organizations everywhere.
In October, a security researchers analysis of a ransomware used by new group called Hunters International
showed substantial code overlaps
with Hive ransomware. A subsequent analysis by Bitdefender found the same similarities, leading researchers at the security vendor to conclude that Hive operators have handed off their crown jewel to another threat actor.
It appears that the leadership of the Hive group made the strategic decision to cease their operations and transfer their remaining assets to another group, Hunters International, Bitdefender said in a
recent report
. While Hive has been one of the most dangerous ransomware groups, it remains to be seen if Hunters International will prove equally or even more formidable.
Hive was one of the most active ransomware groups at the time the FBI, in concert with counterparts in Germany and the Netherlands, hacked into the groups infrastructure and
systematically neutralized it
over a seven-month period.
During that time, investigators
captured over 300 decryption keys
from Hive operators and handed them off to victims who were under active attack, saving them a cumulative $130 million in losses. Investigators also found — and handed over — an additional 1,000 decryption keys associated with victims of earlier Hive group attacks. The FBI and its partners seized control of websites and servers that Hive was using at the time, effectively shutting down its operational capabilities.
In the months since then, Hives operators appear to have transferred their code to Hunters International, a threat group with a relatively low number of victims at the moment but with a mature toolkit and a seeming eagerness to show its capabilities.
Reputation plays a critical role in the ransomware-as-a-service model, and after the disruptions and months-long law enforcement breach of the Hive ransomware group, Hunters International faces the task of demonstrating its competence before it can attract high-caliber affiliates, Bitdefender said.
The threat actor behind Hunters International have made clear that they are not a rebranded version of Hive and are instead an independent group thats using Hive malware and infrastructure. Evidence points to that indeed being the case, Bitdefender said.
The groups primary focus for example appears to be on extortion via data exfiltration rather than data encryption, which is different from the Hive operation. Hunter Internationals victim list — which includes organizations in the US, UK, Germany, and Namibia — suggests that its attacks so far are opportunistic rather than targeted, another sign of a group thats still finding its way in the ransomware space.
Bitdefenders analysis of the malware also shows that Hunter International is using logging, a clear indication the group has adopted the code from someone else, says Martin Zugec, technical solutions director at Bitdefender in comments to Dark Reading.
When a new developer, such as the Hunters group, acquires or inherits code, enabling logging and debugging is a crucial step in understanding and improving that code. Logging offers insights into how the code operates, tracks errors, and helps debugging and improving the malware.
Zugec says Hives decision to sell its malware points to the challenge that criminal groups often face when trying to recover from a successful takedown.
Unlike a legitimate business that might recover from backups, for threat actors, restoration isnt just about systems; its about evading legal consequences and rebuilding an illegal operation, he says. Its a time-consuming and effort-intensive process. Thus, the decision to sell their code might stem from the belief that the effort and resources required to restart and evade law enforcement might not be worth it.
Zugec says its hard to determine the price that Hive actors might have wanted — or that Hunters International paid — for the ransomware code. Typically, an affiliate operation like Hunters would be willing to pay a premium for ransomware with a good reputation for speed recovery, high data retrieval rates, and resistance to decryptors.
The value of the code, extends beyond its technical capabilities; it includes the trust and established reputation of the ransomware in the cybercriminal community.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Hunters International Cyberattackers Take Over Hive Ransomware