hunters
First seen October 20, 2023Active307 claimed victims
The claims below are reproduced as posted by hunters on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
In mid-October 2023, just a few days before the Europol operation, the source code of the Ransomware Hive was sold, along with its website and older versions developed in Golang and C (although this purchase has only been reported by the actors without concrete evidence). The buyer of this new source code was the group Hunters International, who claimed to have fixed the bugs in the Ransomware Hive that were responsible for preventing file decryption in some cases.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| GW Mechanical | October 4, 2024 | ransomware_live | — |
| Amplitude Laser | October 4, 2024 | ransomware_live | — |
| CaleyWray | October 3, 2024 | ransomware_live | — |
| CobelPlast | October 3, 2024 | ransomware_live | — |
| Trev Deeley Motorcycles | September 30, 2024 | ransomware_live | — |
| DJH Jugendherberge | September 18, 2024 | ransomware_live | — |
| AutoCanada | September 17, 2024 | ransomware_live | — |
| New Electric | September 17, 2024 | ransomware_live | — |
| Associated Building Specialties | September 13, 2024 | ransomware_live | — |
| HB Construction | September 13, 2024 | ransomware_live | — |
| Arch-Con | September 13, 2024 | ransomware_live | — |
| VIcom Corporation | September 13, 2024 | ransomware_live | — |
| ICBC London | September 11, 2024 | ransomware_live | — |
| ICBC (London) | September 11, 2024 | ransomware_live | — |
| Bank Rakyat | September 10, 2024 | ransomware_live | — |
| SESAM Informatics | September 6, 2024 | ransomware_live | — |
| Custom Security Systems | September 5, 2024 | ransomware_live | — |
| Sunrise Erectors | September 4, 2024 | ransomware_live | — |
| Quálitas México | September 1, 2024 | ransomware_live | — |
| Therabel Lucien Pharma SAS | September 1, 2024 | ransomware_live | — |
| Navitas Semiconductor | August 30, 2024 | ransomware_live | — |
| Rinehart Butler Hodge Moss & Bryant | August 28, 2024 | ransomware_live | — |
| Crowe | August 27, 2024 | ransomware_live | — |
| US Marshals Service | August 26, 2024 | ransomware_live | — |
| Crimson Interactive | August 23, 2024 | ransomware_live | — |
| Akkanat Holding | August 20, 2024 | ransomware_live | — |
| Ferraro Group | August 19, 2024 | ransomware_live | — |
| BTS Biogas | August 16, 2024 | ransomware_live | — |
| SuperDrob S.A. | August 16, 2024 | ransomware_live | — |
| Hanon Systems | August 11, 2024 | ransomware_live | — |
| Anderson Oil & Gas | August 7, 2024 | ransomware_live | — |
| Fractalia Group | August 6, 2024 | ransomware_live | — |
| Casco Antiguo | August 6, 2024 | ransomware_live | — |
| Omni Family Health | August 6, 2024 | ransomware_live | — |
| LRN | August 3, 2024 | ransomware_live | — |
| Khandelwal Laboratories Pvt | August 2, 2024 | ransomware_live | — |
| Jangho Group | August 2, 2024 | ransomware_live | — |
| ENEA Italy | August 1, 2024 | ransomware_live | — |
| Kleven Construction | July 31, 2024 | ransomware_live | — |
| Durham Manufacturing | July 31, 2024 | ransomware_live | — |
| Priefert | July 29, 2024 | ransomware_live | — |
| The Gill Corporation | July 29, 2024 | ransomware_live | — |
| Crownlea Group | July 29, 2024 | ransomware_live | — |
| Rumpke Consolidated Companies | July 28, 2024 | ransomware_live | — |
| Physical & Occupational Therapy Examiners ofTexas | July 25, 2024 | ransomware_live | — |
| Physical & Occupational Therapy Examiners of Texas | July 25, 2024 | ransomware_live | — |
| Betances Health Center | July 24, 2024 | ransomware_live | — |
| Arcmed Group | July 19, 2024 | ransomware_live | — |
| Santa Rosa | July 18, 2024 | ransomware_live | — |
| Seamon Whiteside | July 18, 2024 | ransomware_live | — |
| Northeast Rehabilitation Hospital Network | July 18, 2024 | ransomware_live | — |
| HOYA Corporation | July 16, 2024 | ransomware_live | — |
| Lantronix Inc. | July 16, 2024 | ransomware_live | — |
| Braum's Inc | July 16, 2024 | ransomware_live | — |
| RZO | July 15, 2024 | ransomware_live | — |
| MS Ultrasonic Technology Group | July 15, 2024 | ransomware_live | — |
| ComNet Communications | July 15, 2024 | ransomware_live | — |
| Gibbs Hurley Chartered Accountants | July 15, 2024 | ransomware_live | — |
| Mercury Theatre | July 15, 2024 | ransomware_live | — |
| Carigali Hess Operating Company | July 13, 2024 | ransomware_live | — |
| Kenya Urban Roads Authority | July 13, 2024 | ransomware_live | — |
| Indika Energy | July 9, 2024 | ransomware_live | — |
| Multisuns Communication | July 4, 2024 | ransomware_live | — |
| Сoquitlam Concrete | July 4, 2024 | ransomware_live | — |
| NetOne | July 3, 2024 | ransomware_live | — |
| WheelerShip | July 2, 2024 | ransomware_live | — |
| Bartlett & Weigle Co. LPA. | July 1, 2024 | ransomware_live | — |
| Circle K Atlanta | June 18, 2024 | ransomware_live | — |
| Acteon Group | June 17, 2024 | ransomware_live | — |
| MRI | June 15, 2024 | ransomware_live | — |
| Legrand CRM | June 15, 2024 | ransomware_live | — |
| Concrete | June 12, 2024 | ransomware_live | — |
| Harper Industries | June 10, 2024 | ransomware_live | — |
| Axip Energy Services | June 7, 2024 | ransomware_live | — |
| RAVEN Mechanical | June 6, 2024 | ransomware_live | — |
| This entry has been removed following a request from the company. | May 28, 2024 | ransomware_live | — |
| Jess-link Products | May 20, 2024 | ransomware_live | — |
| Formosa Plastics USA | May 17, 2024 | ransomware_live | — |
| Treasury of Cote d'Ivoire | May 13, 2024 | ransomware_live | — |
| Aero Tec Laboratories | May 13, 2024 | ransomware_live | — |
| Pella | May 10, 2024 | ransomware_live | — |
| Trade-Mark Industrial | May 8, 2024 | ransomware_live | — |
| Richelieu Foods | May 8, 2024 | ransomware_live | — |
| Noritsu America Corp. | May 7, 2024 | ransomware_live | — |
| Hibser Yamauchi Architects | May 7, 2024 | ransomware_live | — |
| Magicolor | April 28, 2024 | ransomware_live | — |
| Rocky Mountain Sales | April 26, 2024 | ransomware_live | — |
| SSS Australia | April 26, 2024 | ransomware_live | — |
| Arrabawn Co-op | April 26, 2024 | ransomware_live | — |
| Central Power Systems and Services | April 24, 2024 | ransomware_live | — |
| Mid-South Health Systems | April 18, 2024 | ransomware_live | — |
| St. Cloud Florida | April 16, 2024 | ransomware_live | — |
| City of St. Cloud, Florida | April 16, 2024 | ransomware_live | — |
| Chicony Electronics | April 15, 2024 | ransomware_live | — |
| Jack Doheny Company | April 14, 2024 | ransomware_live | — |
| Frederick Wildman and Sons | April 13, 2024 | ransomware_live | — |
| Integrated Control | April 13, 2024 | ransomware_live | — |
| NanoLumens | April 13, 2024 | ransomware_live | — |
| Caxton and CTP Publishers and Printers | April 13, 2024 | ransomware_live | — |
| Kablutronik SRL | April 13, 2024 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).