hunters
First seen October 20, 2023Active307 claimed victims
The claims below are reproduced as posted by hunters on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
In mid-October 2023, just a few days before the Europol operation, the source code of the Ransomware Hive was sold, along with its website and older versions developed in Golang and C (although this purchase has only been reported by the actors without concrete evidence). The buyer of this new source code was the group Hunters International, who claimed to have fixed the bugs in the Ransomware Hive that were responsible for preventing file decryption in some cases.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Eight8Ate Holdings, Inc | May 27, 2025 | ransomware_live | — |
| Wrap & Send Services | May 27, 2025 | ransomware_live | — |
| Corantioquia | May 27, 2025 | ransomware_live | — |
| Sioux Chief | May 5, 2025 | ransomware_live | — |
| GPF Lewis | May 5, 2025 | ransomware_live | — |
| FCC | April 30, 2025 | ransomware_live | — |
| Digestive Specialists | April 30, 2025 | ransomware_live | — |
| Telco Intercontinental | April 30, 2025 | ransomware_live | — |
| Minnesota Lawyers Mutual Insurance | April 28, 2025 | ransomware_live | — |
| Kasb Bank - K-Trade | April 25, 2025 | ransomware_live | — |
| Kenworth Del Sur | April 25, 2025 | ransomware_live | — |
| Mafi | April 23, 2025 | ransomware_live | — |
| Pharma Force | April 21, 2025 | ransomware_live | — |
| HOPI | April 17, 2025 | ransomware_live | — |
| IDS Infotech | April 6, 2025 | ransomware_live | — |
| Hofmann Fördertechnik GmbH | April 6, 2025 | ransomware_live | — |
| Groupe Delcourt | April 6, 2025 | ransomware_live | — |
| Blackmon Mooring | April 5, 2025 | ransomware_live | — |
| Nexia Poyiadjis IT | April 5, 2025 | ransomware_live | — |
| National Sign corp | April 4, 2025 | ransomware_live | — |
| Sansone Group | April 4, 2025 | ransomware_live | — |
| Megacentro | March 20, 2025 | ransomware_live | — |
| Cargills Bank | March 20, 2025 | ransomware_live | — |
| CableVision | March 17, 2025 | ransomware_live | — |
| Courageous Home Care | March 16, 2025 | ransomware_live | — |
| Edesur Dominicana | March 11, 2025 | ransomware_live | — |
| Tata Technologies | March 4, 2025 | ransomware_live | — |
| Kendall Auto Group | February 26, 2025 | ransomware_live | — |
| Vermeer Mexico | February 25, 2025 | ransomware_live | — |
| CCOO Servicios | February 22, 2025 | ransomware_live | — |
| SPEED Co | February 22, 2025 | ransomware_live | — |
| Swissmem | February 17, 2025 | ransomware_live | — |
| Nichino Ryokka Co Ltd | February 11, 2025 | ransomware_live | — |
| SAKAI SOUKEN Co. | February 8, 2025 | ransomware_live | — |
| Robertshaw | February 6, 2025 | ransomware_live | — |
| Omni United | February 4, 2025 | ransomware_live | — |
| PetroVietnam Exploration Production Corporation | January 20, 2025 | ransomware_live | — |
| Unisource Information Services | January 11, 2025 | ransomware_live | — |
| RocSearch | January 11, 2025 | ransomware_live | — |
| COROB | January 11, 2025 | ransomware_live | — |
| Patriarche Office of Architecture | January 11, 2025 | ransomware_live | — |
| Costex | January 11, 2025 | ransomware_live | — |
| Barber Specialties | January 11, 2025 | ransomware_live | — |
| T. Hasegawa USA | January 11, 2025 | ransomware_live | — |
| TEDOM | January 11, 2025 | ransomware_live | — |
| Nikki-Universal Co Ltd | January 3, 2025 | ransomware_live | — |
| Family Help & Wellness | December 26, 2024 | ransomware_live | — |
| Archetype Group | December 18, 2024 | ransomware_live | — |
| Development Bank of Jamaica | December 18, 2024 | ransomware_live | — |
| Microvision | December 18, 2024 | ransomware_live | — |
| Astaphans | December 18, 2024 | ransomware_live | — |
| SeaLandAire Technologies | December 15, 2024 | ransomware_live | — |
| Ecritel | December 8, 2024 | ransomware_live | — |
| InterCon Construction | December 3, 2024 | ransomware_live | — |
| Aeris Energy | November 23, 2024 | ransomware_live | — |
| Jones & Mayer | November 23, 2024 | ransomware_live | — |
| Telecom Namibia | November 21, 2024 | ransomware_live | — |
| CK Power Public Manufacturing | November 20, 2024 | ransomware_live | — |
| Performance Health & Fitness | November 19, 2024 | ransomware_live | — |
| AFD | November 19, 2024 | ransomware_live | — |
| Dorner Law & Title Services | November 18, 2024 | ransomware_live | — |
| Mantinga | November 17, 2024 | ransomware_live | — |
| Horsa | November 16, 2024 | ransomware_live | — |
| Southern Acids | November 16, 2024 | ransomware_live | — |
| A&O IT Group | November 15, 2024 | ransomware_live | — |
| Wintergreen Learning Materials | November 15, 2024 | ransomware_live | — |
| Kumla Kommun | November 14, 2024 | ransomware_live | — |
| R Pac Central America S.A. de C.V. | November 14, 2024 | ransomware_live | — |
| Sercomm | November 13, 2024 | ransomware_live | — |
| Schmack | November 13, 2024 | ransomware_live | — |
| Dietzgen Corporation | November 11, 2024 | ransomware_live | — |
| IAС | November 10, 2024 | ransomware_live | — |
| Conteg | November 10, 2024 | ransomware_live | — |
| Ace Laboratories Limited | November 8, 2024 | ransomware_live | — |
| New Law | November 7, 2024 | ransomware_live | — |
| Hemubo | November 3, 2024 | ransomware_live | — |
| Amourgis & Associates | November 2, 2024 | ransomware_live | — |
| Cerp Bretagne Nord | November 1, 2024 | ransomware_live | — |
| SmartLynx Airlines SIA | October 31, 2024 | ransomware_live | — |
| Niko Resources Ltd. | October 25, 2024 | ransomware_live | — |
| Ambica Steels | October 25, 2024 | ransomware_live | — |
| European External Action Service (EEAS) | October 25, 2024 | ransomware_live | — |
| Banco Sucredito Regional S.A.U. | October 25, 2024 | ransomware_live | — |
| IdeaLab | October 22, 2024 | ransomware_live | — |
| Atende Software's | October 20, 2024 | ransomware_live | — |
| JN attorney | October 20, 2024 | ransomware_live | — |
| Michael J Gurfinkel | October 19, 2024 | ransomware_live | — |
| KMC Controls | October 19, 2024 | ransomware_live | — |
| Aaren Scientific | October 15, 2024 | ransomware_live | — |
| Parnell Defense | October 15, 2024 | ransomware_live | — |
| Elmore Goldsmith | October 11, 2024 | ransomware_live | — |
| Protective Industrial Products | October 11, 2024 | ransomware_live | — |
| Glacier | October 10, 2024 | ransomware_live | — |
| Structural and Steel Products | October 10, 2024 | ransomware_live | — |
| Orshan, Spann & Fernandez-Mesa | October 9, 2024 | ransomware_live | — |
| AIUT | October 8, 2024 | ransomware_live | — |
| Air Specialists Heating & Air Conditioning | October 7, 2024 | ransomware_live | — |
| BNBuilders | October 5, 2024 | ransomware_live | — |
| Ibermutuamur | October 5, 2024 | ransomware_live | — |
| Dreyfuss + Blackford Architecture | October 4, 2024 | ransomware_live | — |
Page 1 of 4Older →
Claim data from ransomware.live and RansomLook (CC BY 4.0).