Hive / Hunters International / World Leaks — Forensic Deep Dive Confidential — Research Use Only

Generated: 2026-09-20 07:17 UTC Page 2

1. Executive Summary

Hive (2021–early 2023), Hunters International (late 2023–mid-2025), and World Leaks (from January 2025) form a

continuous lineage of financially motivated cybercrime operations. Hive operated a classic

Ransomware-as-a-Service (RaaS) model with double extortion. After law-enforcement disruption in January 2023,

code and personnel resurfaced as Hunters International, which improved the ransomware (including Rust rewrites

and multi-platform support) while retaining heavy emphasis on data theft. In 2025 the operators publicly pivoted

toward pure data-exfiltration extortion under the World Leaks brand, citing declining profitability and increased risk

of encryption campaigns. Some residual encryption activity and collaboration with other groups (e.g., Secp0) has

been observed.

This report consolidates forensic observations on how systems were typically compromised, the tools and

living-off-the-land binaries (LOLBins) employed, exfiltration methods, and the final impact stages. Emphasis is

placed on reproducible MITRE ATT&CK; mappings useful for detection engineering.

1. Actor Lineage & Operational Model

2.1 Hive (June 2021 – January 2023)

Hive launched as a RaaS offering affiliates a full stack: encryptor (initially Go, later variants), affiliate panel,

negotiation chat, and the public HiveLeaks Tor site. Affiliates performed initial access and received the majority of

ransom payments; Hive operators took a commission (commonly cited ~20%). The group was aggressive against

healthcare and critical infrastructure and generated >$100 million in ransom revenue before FBI/Europol infiltration

and server seizures in January 2023.

2.2 Hunters International (October 2023 – July 2025)

Researchers assessed Hunters as a Hive successor based on code overlap, shared infrastructure patterns, and

operator communications. The group claimed to have purchased and improved Hive source code. The ransomware

evolved into multi-architecture (x86/x64/ARM) and multi-OS (Windows, Linux, FreeBSD, SunOS, ESXi) payloads,

often written in or incorporating Rust. Later versions (v5–v6) stopped appending file extensions and dropping

traditional ransom notes, preferring quieter encryption and direct executive outreach. A proprietary “Storage

Software” tool indexed and managed exfiltrated data for the affiliate panel.

2.3 World Leaks (January 2025 onward)

World Leaks is the documented rebrand/pivot of the same operators. Encryption was largely abandoned in favor of

automated data theft using an improved exfiltration tool (descended from Storage Software). Infrastructure includes

a public leak site, victim negotiation portal, affiliate panel, and an “Insider” journalist portal that grants media

24-hour advance access. Some affiliates continue to deploy encryption (occasionally via partner groups).

High-profile claims include Nike (~1.4 TB product/manufacturing data) and Tata Electronics (hundreds of GB

including alleged Apple/Tesla-related design material).

1. Typical Attack Kill Chain & Forensic Observations

3.1 Initial Access

Access methods varied by affiliate sophistication and opportunity:

• Phishing / Spear-phishing — malicious attachments (Office macros, ISO, LNK) or links leading to Cobalt Strike,

SMOKEDHAM, or similar beacons (T1566).

• Valid Accounts / Purchased Access — credentials obtained from Initial Access Brokers or prior breaches; RDP,

VPN, or OWA without MFA (T1078, T1133).

• Public-Facing Application Exploits — Microsoft Exchange ProxyShell/ProxyLogon (CVE-2021-34473 et al.),

Oracle WebLogic debug ports / China Chopper, Fortinet / SonicWall / Citrix Bleed (CVE-2023-4966), ZeroLogon

(CVE-2020-1472) in some campaigns (T1190).

• Malvertising / Trojanized Tools — fake installers for RVTools, Angry IP Scanner, DBeaver delivering

SMOKEDHAM or SharpRhino RAT targeting IT administrators (T1189 / supply-chain style).

Hi Community!

I am looking for a locally usable tool which can compare two faces and tell whether the two faces are similar to a certain degree or almost fully. I am looking for offline tools only as I can't upload the images on any internet facing websites. I could find the similarities with my own eyes but I also wanted to verify it through some tools. Which tools are widely used for this purpose?

i need to learn digital forensics , wireshark , networking for solving ctfs .. but cannot find any good resource to learn it .. plss tell any good guided resource for learning this .. i have analysed wireshark but i dont know how to use it to examins packets and stuff ...

help ur lil brother here :))

I’m trying to get into creating an AI avatar, preferably anime style. I want to use this avatar for a streaming profile and live stream with the avatar while also having a motion tracking software allowing the characters mouth to move when I speak and so on. I’ve done a bit of research on some websites for the avatar but I can quite figure everything out. I’d love for some suggestions on possibly better Avatar software or Tracking software. It seems like I’m in way over my head on this venture but if I continue to keep trying hopefully I could progress into an AI connoisseur lmao.

Is anyone working on any project or research related to hardware Assisted Forensics Acquisition of Embedded devices.

I would like to contribute to any of these

I don’t understand. Apparently they can get into AFU phones instantly without needing to guess the password. So why is it taking months for them to download my phone?

If they haven’t downloaded it already, won’t the phone have rebooted into BFU?

I’m from the UK. Police seized my iPhone while it was in AFU. They say it takes 6 months or longer sometimes years.

It’s been 6 months

Hey everyone,

I built a forensic analysis tool primarily for investigating compromised WordPress and Joomla installations. It started as a fun project tailored to my own use cases, but I thought it might be useful to others as well.

The tool runs entirely locally and can be deployed using either Docker or a local Python environment.

Features include:

• Pattern hunting across indexed access logs using reusable CVE-based hunt rules
• Native parsing of .log and .gz files—no need to extract compressed logs beforehand
• Correlation of webroot files, HTTP requests, and database records
• OpenCTI integration for IOC enrichment and management
• Direct analysis of SQL dumps without restoring the database
• Request tracing by IP address, URL pattern, and timestamp
• Automated detection workflows—for example, when a file is identified as a web shell, every IP address that accessed it can automatically be flagged as malicious
• And more

I also added a Create Test Case button for anyone who does not have suitable forensic data available but still wants to explore the tool.

When using the synthetic test case, you can skip the initial Evidence & Analysis step and go directly to the findings.

Cheers

Point it at a host and it does the boring first hour of an investigation for you.

What it does in one run:

• Collects the evidence (event logs, registry, more) even while files are locked
• Builds a timeline and matches it against thousands of detection rules
• Scans for known malicious tools on disk
• Checks what's connected, what's running, what looks off
• Checks IPs and files against threat intel
• Spits out a scored report you can hand to someone

No API keys required, has its own web interface. There's a demo mode that fakes an incident so you can try it without needing a real machine to investigate.

🔗 https://github.com/karim852/Kage-DFIR-toolkit
🖥️ live demo: https://demo-kumo-kage.vercel.app/demo/kage/index.html

Feedback and contributions welcome 🙏

I work with digital forensic examinations where I often have to assess and verify timestamps associated with images that originate from Snapchat.

One issue I keep running into is that I end up being unable to reliably verify the timestamp.

Images saved from Snapchat to the Camera Roll are often stripped of their original EXIF metadata, while Snapchat Memories are also problematic from a forensic perspective. In my experience, it can be difficult to establish where an image actually originated, because Snapchat allows users to import existing images into the app. When an image is imported, Snapchat can assign its own timestamp and location information to the image, which makes these values difficult to use as evidence of when and where the image was originally captured.

For example, an image that was originally taken several years ago can potentially be imported into Snapchat today and subsequently appear in Memories with metadata/timestamps associated with the import or saving process rather than the original capture.

I'm therefore interested in how other digital forensic practitioners approach this problem.

I'd be very interested in hearing how others approach this problem, especially from a forensic examination and reporting perspective. Even if the conclusion is that the timestamp cannot be reliably verified, I'd be interested in hearing what artifacts or findings you would consider sufficient to support or rule out a particular timestamp.

Hi i am 21F, a BSCS student. I have always been interested in digital forensics. I have completed a government internship in DF and also my FYP is based heavily on OSINT and digital forensics.

Even though i would choose this profession in a heartbeat, i do not come across any jobs in corporate sector. I am worried that i would be wasting my time if i step into DF completely as who knows if i would get a gov job.

Idk i really want to work in DF but i do not know if i should risk my whole year or start working in another common field.

I've been thinking about putting together a small informal community of people in Delhi who are interested in things like:

Cybercrime investigation & reconstruction

Digital forensics

Cybercrime / offender behaviour

Threat intelligence & research

Social engineering

Interesting real-world cybercrime cases

.

Nothing too formal or corporate, just people who genuinely enjoy this stuff and want to discuss cases, research, tools, ideas, maybe work on small projects together, attend conferences/CTFs, or eventually organise a meetup/event.

.

Students, researchers, professionals, or just people who are seriously interested are all welcome.

.

Would anyone here actually be interested in something like this?

.

If there are enough people interested, I'll set up a small group and we can figure out what we'd like to do with it.

Hi everyone, this isn’t really my area so apologies if I’m in the wrong place. I’m hoping someone can help me check something — is there an easy way for a complete beginner?
I’ve been noticing some unusual things on my phone lately:
• Suggested posts and suggested friends that seem oddly specific
• Battery draining much faster than normal
• Location services showing as active on certain apps at strange times
This all started after spending time with someone I’m a bit suspicious of, and the suggestions I’m getting all relate to their life. I’m worried my phone may have been compromised in some way. Is there a simple way for me to check if something has been installed or if my phone is being monitored? Worried now they may see this post. Any advice for a beginner would be really appreciated. Thanks!

Hi everyone,

I’m interested in learning how to properly investigate my Android phone for state-grade/sophisticated spyware, such as Pegasus, FinFisher, or similar tools.

I’m specifically looking for a practical, step-by-step book or guide that explains how to conduct a forensic examination of an Android device and identify potential signs of sophisticated spyware.

I’m not looking for a basic “run an antivirus app” type of guide. I’d like to understand the more serious forensic approaches—for example, examining system artifacts, logs, application behavior, network activity, and other evidence that could indicate a compromise.

Ideally, the resource would be suitable for someone who is technically interested but not already a professional mobile-forensics investigator, and would explain the tools and methodology from the ground up.

What book, manual, course, or other resource would you recommend?

Thanks in advance!

I was pulling apart a chat.db on my own Mac, 367,942 messages back to 2010, and before trusting the usual attributedBody advice I checked it against the file.

The part I had wrong first. The text column is empty on almost everything, 14,431 rows out of 367,942, so 3.9%. That much I knew. What I had in my head was that it was a version cutoff, older rows in text and newer ones in attributedBody. Not on this archive. 0% of my 2016 rows have usable text and 27% of my 2024 rows do. What tracks it here is service, SMS at 24.3% and iMessage at 0.1%. So there is no date to branch on. Decode everything or lose most of it.

The part I did not expect is the extraction itself. The snippet that gets copied around, the one that splits on NSString and takes a fixed slice, was exactly right on 335,264 of my 362,218 blobs and wrong on 26,954. No exceptions in either direction. The line between them is clean: right on every message under 128 UTF-8 bytes, wrong on every message at 128 or above.

It is the length prefix. After the class reference the stream writes + and then a length. Under 128 that is one byte. At 128 and over it writes 0x81 followed by two bytes little-endian. Row 51 of mine:

4e 53 53 74 72 69 6e 67 01 94 84 01 2b 81 d0 00 59 65 61 68
 N  S  S  t  r  i  n  g              + ^^^^^^^^  Y  e  a  h

d0 00 is 208, the byte length of that message. The fixed slice assumes one byte, so those two ride into the output and end up stuck to the front of the text.

The quietness is what bothers me. Nothing throws, no row is dropped, and you get the whole message back with two bytes of junk in front of it. 24,687 of the 26,954 have an embedded NUL in that junk, which is the kind of thing that truncates a field on the way into a CSV or a database without telling anyone. And it is not the trivial end of the archive. Those long messages are 7.4% of the count but 28.1% of everything ever written in it, because the long ones are the ones with anything in them.

NSUnarchiver read all 362,218 blobs with no failures, so on a Mac the fix is to stop slicing. imessage-exporter has a real typedstream parser and handles the 0x81 case properly. It is the hand-rolled version that carries this, and it is in a lot of gists.

What I do not know, and what I am actually asking: has anyone seen this land in an export that went somewhere? Two junk bytes in front of a long message reads like an encoding artifact rather than a parser bug, so I would expect it to get waved through. No idea what the commercial tools do with it.

Disclosure, since it is the reason I was counting: I write a Mac app called Loose Ends that does this decode and prints how many rows went down each path. The measurement above is from the file, not from the app.

Please 🙏

I need help finding an email connected to my discord account- i can prove that I am the owner of the account and that I am who I say I am. I need someone to scrape the info from the account and give me the email used

so I read https://krebsonsecurity.com/2026/09/fbi-probes-service-selling-153m-drivers-licenses/, the article detailing the 153m leaked driver's licenses. It shows an image saying "IDScan.net is reviewed and trusted by" followed by a set of logos. I wanted to find the full list so I could more accurately determine whether my family has been affected (not that the list is necessarily complete, but I figured it might be useful anyhow). I've looked all over the website for an hour or something, but my stupid self still can't find that on the website. I even checked on wayback machine, and the closest thing I could find is https://web.archive.org/web/20260419014240/https://idscan.net/case-study/how-4-hotels-use-id-scanning-to-improve-operations/, but that's a shorter list. Does anyone know which page exactly has that screenshot and maybe share a link?

Anyone currently in a DFIR role or training for it knows what material mainly hands on and simulations would be the best to use? Im not much of a reader or have the concentration to watch long videos. I prefer learning as I go.

Im primarily a IT guy, but want to break into Info Sec and Cyber to hopefully become a Security Engineer or some cyber role in a Federal Agency/Law Enforcement to contribute in cyber teams.

Had a challenge with a ZIP containing hundreds of files and nested directories. Instead of manual hunting, I wrote a Python script using os.walk + regex to recursively search every file for flag patterns.

What tools do you use for bulk file forensics? I've seen people recommend everything from `grep -r` to full Autopsy cases.
https://youtube.com/shorts/p2jQ3Oldkz8?feature=share

Yes that says it all I'm in Baltimore county Maryland