World Leaks

THREAT ACTOR PROFILE

World Leaks

World Leaks is a data-extortion operation that launched in 2025 as a rebrand of Hunters International, which itself emerged from the dismantled Hive ransomware group. It positions itself as exfiltration-only, running Tor leak, negotiation and journalist portals, but incident reporting shows it still encrypts victims in some intrusions.

Not attributed

Data theft / Extortion

First seen

2023

Latest IOC

IP indicators

Hosts

SHA256 hashes

Posts

TABLE OF CONTENTS

Names and aliases

Group profile

Attack lifecycle

Malware and tooling

IOCs

Notable campaigns

NAMES AND ALIASES

World Leaks, Hunters International and the Hive lineage

World Leaks is tracked under its current and former brand names, with a lineage back to Hive. They map to one entry among the ransomware and extortion actors we track, and it operates in the same rebrand-driven space as RansomHub.

GROUP PROFILE

An extortion rebrand that still encrypts

World Leaks runs a data-theft extortion model: steal data, threaten publication, and pressure victims through leak and negotiation portals. It launched on January 1, 2025 as a rebrand of Hunters International, which grew from Hive's dismantled infrastructure.

Our record ties it to data theft and extortion. It has listed more than 170 victims across many countries, with a surge against Indian organizations, including sensitive exposure tied to Reliance Infrastructure and a nuclear power plant's data.

Despite its stated exfiltration-only model, Darktrace observed a World Leaks intrusion that both stole and encrypted data, so defenders should treat it as capable of encryption as well as extortion.

Facts:

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Victims reported in our records and posts:

ATTACK LIFECYCLE

Edge exploits and brute force into data theft

The stages below come from World Leaks and Hunters International activity in posts we track on our IOC Hunter feed.

Initial Access

Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.

Initial Access

MALWARE AND TOOLING

SharpRhino, RustyRocket and leak infrastructure

Initial Access

CVES EXPLOITED

FortiOS, CrushFTP and web framework flaws

CVE-2026-21509

A Microsoft Office security bypass used to open the fileless chain in Operation Neusploit, and again in the PixyNetLoader intrusion chain. Both campaigns paired the exploit with spear-phishing from compromised accounts rather than mass exploitation.

CVE-2026-21509

World Leaks

IOCS FROM HUNT.IO PLATFORM

Latest IOCs

We currently track - IP indicators, - hosts, and - SHA256 hashes for Akira across - intelligence posts, with the most recent indicator dated -. The sample below is limited to indicators from the latest posts. It is not the full set.

Showing a sample of recent indicators

Get the complete

World Leaks

IOC set, full IP, host and hash history.

Unlock all the IOCs for Free

Showing a sample of recent indicators

Get the complete

World Leaks

IOC set, full IP, host and hash history.

Unlock all the IOCs for Free

NOTABLE CAMPAIGNS

Indian targeting and a still-encrypting rebrand

Recent reporting tracks World Leaks' rebrand and its 2026 activity.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.