hunters

Tácticas y técnicas observadas del actor, mapeadas a MITRE ATT&CK (clic para ver la ficha oficial). Útil para priorizar detecciones.

Firma de detección defensiva para este grupo (úsala en tu EDR/SIEM). Fuente: ransomware.live.

/*
Hunters International ransomware (successor to Hive)
*/

rule HuntersInternational_Ransomnote
{
    meta:
        author = "ransomware.live"
        family = "ransomware.hunters"
        description = "Detects Hunters International ransom note"
        date = "2026-05-04"
        severity = 7
        score = 70

    strings:
        $s1 = "Hunters International" ascii nocase
        $s2 = "Contact.txt" ascii nocase
        $s3 = ".hunters" ascii
        $s4 = "hunters55i2i" ascii nocase

    condition:
        any of them
}

rule HuntersInternational_PE
{
    meta:
        author = "ransomware.live"
        family = "ransomware.hunters"
        description = "Detects Hunters International ransomware executable"
        date = "2026-05-04"
        severity = 9
        score = 90

    strings:
        $s1 = "Hunters International" ascii wide
        $s2 = ".hunters" ascii
        $s3 = "hunters55i2i" ascii

    condition:
        uint16(0) == 0x5A4D and 2 of them
}

_   _ _   _ _   _ _____ _____ ____  ____
 | | | | | | | \ | |_   _| ____|  _ \/ ___|
 | |_| | | | |  \| | | | |  _| | |_) \___ \
 |  _  | |_| | |\  | | | | |___|  _ < ___) |
 |_|_|_|\___/|_|_\_|_|_|_|_____|_|_\_\____/____ ___ ___  _   _    _    _
 |_ _| \ | |_   _| ____|  _ \| \ | |  / \|_   _|_ _/ _ \| \ | |  / \  | |
  | ||  \| | | | |  _| | |_) |  \| | / _ \ | |  | | | | |  \| | / _ \ | |
  | || |\  | | | | |___|  _ <| |\  |/ ___ \| |  | | |_| | |\  |/ ___ \| |___
 |___|_| \_| |_| |_____|_| \_\_| \_/_/   \_\_| |___\___/|_| \_/_/   \_\_____|
To contact us follow the instructions:
1) Install and run “Tor Browser” from [redactado]
2) Go to [redactado]
3) Log in using the credentials: [snip]
---
Don't waste time. Inform your CEO about the incident ASAP. Show Data Leak Site:
[redactado]

• https://www.ransomware.live/group/hunters

• Energy
  4
• Manufacturing
  3
• Public Sector
  2
• Transportation/Logistics
  2
• Financial Services