Hunters International Ransomware Recovery: What's Recoverable

Hunters International emerged in late 2023 and is widely assessed to be a successor to the Hive ransomware operation, based on substantial overlap in its code. It ran as a ransomware-as-a-service, with affiliates carrying out the attacks, and claimed more than 300 victims over its lifetime, concentrated in North America. In 2025 the operation wound down: it moved toward a data-extortion-only model called World Leaks and, as it shut the encryption side down, published free decryptors for its victims.

Attacks typically began with stolen or purchased network access, followed by data theft and then encryption — the double-extortion model, with stolen data published on a leak site to pressure payment. The encryptor was written in Rust and had versions for Windows, Linux and VMware ESXi, so a single intrusion could take out servers, virtual machines and their datastores together.

Encrypted files were commonly given a .locked extension, with a ransom note left for contact. Like most modern families, it encrypted large files only in part to finish quickly.

Most ransomware cases offer no path to decryption without paying. Hunters International is an exception. When the operation shut down in 2025 it released decryption keys and tools for affected victims. If you were hit by Hunters International, decrypting the files directly may be possible — which is not the case for most families.

The caveats matter: a released decryptor has to be the right one for the variant that hit you, it must come from a trustworthy source, and it should always be tested on copies, never your only encrypted set. It may not restore every file cleanly, especially where the encryptor damaged file structures.

Start by preserving everything exactly as it is — encrypted files, the ransom note and the affected systems — because every recovery route depends on it. If a valid decryptor is available, that is usually the fastest path, applied to copies and verified against a known-good file.

Where the decryptor is unavailable, incomplete, or leaves files damaged, recovery falls back to the usual sources: backups the attackers could not reach, hypervisor or array snapshots that survived, and the large database and virtual-disk files that were only partly encrypted and can be rebuilt from their surviving regions. An assessment of the actual files shows which of these applies before anything is rebuilt or 'cleaned up'.