Hunters International
Widely assessed (OSINT) as a successor to Hive after that group was taken down in 2023; shares code with INC Ransom.
Claimed victims
308
Top region
—
Top sector
—
Suspected origin
Russia
Latest claimed victims
Victims as claimed by the group on its leak site and tracked in our graph — claims are not independently verified, and listing here is not confirmation a breach occurred.
| Date | Organisation (claimed) | Sector | Country |
|---|---|---|---|
| 2025-05-27 | Wrap & Send Services | — | — |
| 2025-05-27 | Eight8Ate Holdings, Inc | — | — |
| 2025-05-27 | Corantioquia | — | — |
| 2025-05-07 | Sioux Chief | — | — |
| 2025-05-07 | GPF Lewis | — | — |
| 2025-04-30 | Telco Intercontinental | — | — |
| 2025-04-30 | FCC | — | — |
| 2025-04-30 | Digestive Specialists | — | — |
| 2025-04-28 | Minnesota Lawyers Mutual Insurance | — | — |
| 2025-04-25 | Kenworth Del Sur | — | — |
Suspected origin
Russia — Hive successor (OSINT); Russian-speaking. Attribution reflects open-source consensus, not certainty.
Suspected affiliates & lineage
Ransomware crews share affiliates, tooling and operators; brands fall and reappear under new names. Related to:
Track it daily
Ransomware moves every day. So does our paper.
The Probably Fine Daily is our morning threat-intelligence briefing — new victims, new groups, what actually matters, in plain English. Free.
Read today's Daily →Browse the archiveDefender-oriented threat intelligence. Nothing here assists an attack. Attribution and lineage reflect open-source reporting.