Ransomware group profile · #24 by claimed victims
Hunters ransomware
In mid-October 2023, just a few days before the Europol operation, the source code of the Ransomware Hive was sold, along with its website and older versions developed in Golang and C (although this purchase has only been reported by the actors without concrete evidence). The buyer of this new source code was the group Hunters International, who claimed to have fixed the bugs in the Ransomware Hive that were responsible for preventing file decryption in some cases. The group also stated that file encryption would not be their primary focus; instead, they would use data theft as a method to pressure victims during extortion attempts.
Victimology
Who Hunters claims to have breached, from 307 leak-site posts recorded by VULONE.
Claims per month last 12 months
Top sectors
Top countries
Latest claimed victims 12 most recent
| Victim | Sector | Country | Claimed |
|---|---|---|---|
| Corantioquia corantioquia.gov.co | Government & Defense | CO | 27 May 2025 |
| Wrap & Send Services wrapandsend.com | Retail & E-Commerce | US | 27 May 2025 |
| Eight8Ate Holdings, Inc eight8ate.ph | Retail & E-Commerce | PH | 27 May 2025 |
| GPF Lewis gpflewis.co.uk | Professional Services | GB | 5 May 2025 |
| Sioux Chief siouxchief.com | Manufacturing | US | 5 May 2025 |
| Telco Intercontinental telcointercon.com | Technology | US | 30 Apr 2025 |
| Digestive Specialists digestivespecialists.com | Healthcare | US | 30 Apr 2025 |
| FCC forumcomm.com | Government & Defense | ES | 30 Apr 2025 |
| Minnesota Lawyers Mutual Insurance mlmins.com | Financial Services | US | 28 Apr 2025 |
| Kenworth Del Sur kenworthdelsur.com.mx | Transportation | MX | 25 Apr 2025 |
| Kasb Bank - K-Trade kasb.com | Financial Services | PK | 25 Apr 2025 |
| Mafi mafi.com | Other | AT | 23 Apr 2025 |
All 307 Hunters victims, searchable
Full victim list with claim posts, domains, timing and exports, plus the negotiation chats and leak-site screenshots VULONE archives for this crew.
Tactics, techniques and procedures
ATT&CK technique mapping for Hunters is in progress. Victimology, infrastructure status and leak-site tracking are live above.
Indicators, detections and the full playbook
Hashes, C2 addresses, onion services, Sigma and YARA detections per technique, and the negotiation transcripts are available to signed-in analysts.
Frequently asked
Is Hunters ransomware still active?
How many victims has Hunters claimed?
Which industries does Hunters target?
Which countries are most affected by Hunters?
Where does VULONE get Hunters victim data?
Other ransomware groups
Victim claims are collected from leak sites and enrichment partners (ransomware.live, RansomLook) and represent the group's own assertions, not confirmed breaches. Profile last updated 16 September 2026. Questions or corrections: [email protected].