World Leaks — Ransomware Profile

World Leaks is a data-extortion operation that launched on January 1, 2025 as the successor to the Hunters International ransomware group, which announced its shutdown on November 17, 2024 citing that the ransomware business had become risky and unprofitable due to government action and geopolitics. Unlike its predecessor, which paired encryption with extortion, World Leaks operates as an extortion-only group and provides affiliates with a purportedly self-developed tool that automates data exfiltration from victim networks. The operation runs a multi-component platform including a public data leak site, a victim negotiation portal, an affiliate management panel, and an insider/journalist portal. Group-IB assesses the rebrand reflects a strategic pivot away from encryption-based ransomware, and Halcyon connects World Leaks to Hunters International through shared infrastructure patterns, victim-notification methodology, and negotiation-portal architecture.

Also tracked as

Hunters International (predecessor)

Tools & malware

Recent claimed victims

Vendor research

Read the full analysis on IntelFusions