The ransomware gang known as Hunter International announced on Thursday it was shutting down on a dark webpage.
“We have carefully considered it and decided to close the Hunter International Project in light of recent developments,” Hacker wrote in the post. “This decision has not been underestimated and we recognize the impact that it will have on the organizations we interact with.”
The hacker also said it offers free decryption keys “to all businesses affected by our ransomware.”
“Our goal is to allow us to recover encrypted data without the burden of paying the ransom,” the gang wrote, asking victims to visit the official website to obtain their decryption key and recover the encrypted files.
At the time of writing, there is no such information on the website.
Hunter International claims several casualties in its two-year existence, including the US Cancer Center and the US Former S-Service. However, law enforcement denied that it was hacked by a cybercrime gang.
The Hunter International Post has announced it is closing it. (Image: TechCrunch)
Several ransomware gangs in the past have released their victim decryption keys and then shut down for different reasons. Perhaps some are shut down just to go back under new names, in an attempt to confuse researchers and law enforcement, and sometimes to escape sanctions. Others decided to call it quits after they had enough funds to retire.
For Hunters International, it's too early for the gang motive to shut down, but there were indications back to April, when the point of rebranding and transitioning to the group called world leaks, according to Allan Liska, a threat intelligence analyst at a cybersecurity company.
“I think this is like 'tie cutting' with old infrastructure,” said Riska, who has been tracking ransomware for years. “As long as you release the decryption key, at this point, they're unlikely to make money from the hunter victims still there, so perhaps they'll see it as a really uncostly gesture.”
World Leaks Group uses new ransomware software and has new sites hosted elsewhere, but the people behind it may be the same, Riska said.
Liska said the reason gangs are dark is that Hive, a ransomware gang seized and closed by the FBI in 2023, “using the same tech infrastructure makes them more vulnerable to law enforcement.”
“Or they gave the wind to the closure of law enforcement and decided to go ahead,” he said.