Loading story…
Group-IB reported that Hunters International, a ransomware group linked to data theft and extortion attacks, is winding down its criminal operation. The group said it would cease activity and provide victims with free decryptors, marking an unusual public shutdown for an active ransomware brand. The development follows the group’s involvement in multiple intrusions in which stolen data and encrypted systems were used to pressure organizations into paying.
The reported closure suggests a possible rebranding, fragmentation, or operational shift rather than a clean disappearance, a pattern seen repeatedly across the ransomware ecosystem. For defenders, the announcement may reduce immediate activity under the Hunters International name, but affiliates, tooling, and tactics tied to the group could persist under new banners, leaving organizations exposed to continued extortion and ransomware risk.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
Group-IB published a blog post titled "The beginning of the end: the story of Hunters International," indicating public reporting and analysis of the ransomware group. No additional incident details are available in the provided reference content.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The FBI and international partners disrupted the infrastructure of **ALPHV/BlackCat**, a major ransomware-as-a-service operation linked to more than 1,000 victims and attacks across U.S. critical infrastructure sectors including healthcare, manufacturing, government, emergency services, schools, and defense-related organizations. U.S. authorities seized multiple ALPHV-operated sites and said an FBI-developed decryptor was provided to more than 500 victims worldwide, helping dozens restore systems and avoid an estimated **$68 million** in ransom payments. Officials described ALPHV as one of the world’s most prolific ransomware groups, and said the investigation remained active even though no arrests were announced. Months later, ALPHV appeared to collapse amid allegations that its operators staged an **exit scam** after receiving a reported **$22 million** ransom tied to the Change Healthcare attack. A new seizure notice posted on the group’s leak site was disavowed by the U.S. Justice Department, Europol, and the U.K. National Crime Agency, while researchers said it reused elements from the legitimate law-enforcement takedown page. Reporting and affiliate claims indicated the group’s leaders kept the payment, cut off an affiliate, and then announced on a cybercrime forum that they were shutting down and planned to sell the malware source code, reinforcing assessments that affiliates may migrate and the operators could reappear under a new brand.
Jun 29, 2026
The **Conti** ransomware syndicate took key parts of its digital infrastructure offline, including sections of its leak site, victim negotiation portal, and internal systems, in what researchers described as a deliberate reorganization rather than a direct law-enforcement takedown. Security firms and reporting tied the move to mounting pressure after a pro-Ukraine insider leaked Conti’s internal chats and tools, exposing the group’s structure, workflows, and links to Russia. The leaks followed Conti’s public declaration of support for Russia after the invasion of Ukraine, a stance that triggered internal backlash and gave investigators an unusually detailed view into one of the world’s most prolific ransomware operations. Researchers said Conti’s shutdown did not mark the end of its activity but a **rebranding and dispersal of personnel** into smaller, harder-to-track units and other extortion groups, including operations such as **ALPHV/BlackCat**. Subsequent reporting indicated former Conti members continued to repurpose the gang’s tooling in campaigns tied to Ukraine, including lures exploiting the **Follina** vulnerability and impersonation themes involving Elon Musk. The episode also underscored why sanctions and disruption efforts struggle to permanently dismantle ransomware groups: even when a major brand collapses, its operators, malware, and playbooks often persist across successor crews.
Jun 29, 2026
CrowdStrike confirmed that an insider was terminated after sharing screenshots of internal systems with the Scattered LAPSUS$ Hunters, a cybercrime collective comprising Scattered Spider, LAPSUS$, and ShinyHunters. The threat actors posted these screenshots on Telegram and claimed to have paid the insider $25,000 for access, including SSO authentication cookies, but CrowdStrike detected the activity and shut down access before any customer data was compromised. The company emphasized that its systems were not breached and that law enforcement has been notified. Meanwhile, the Scattered LAPSUS$ Hunters collective has escalated its operations, launching a new Telegram channel and increasing its public activity. The group, which has a history of social engineering and SaaS supply chain breaches, is also linked to the development of a new ransomware-as-a-service platform called ShinySp1d3r. This RaaS, created by ShinyHunters and Scattered Spider, is being built from scratch and features advanced capabilities, signaling a shift from using third-party ransomware to deploying their own tools in future attacks.
Jun 29, 2026