--- title: "Hunters International: New ransomware based on Hive source code" description: Hunters International ransomware was first spotted in October 2023. While it shares many similarities with Hive ransomware, it is not a rebrand. But like Hive, Hunters International works as ransomware as a service (RaaS) and besides encryption, it also exfiltrates victim data. canonical_url: https://www.acronis.com/en/tru/posts/hunters-international-new-ransomware-based-on-hive-source-code/ locale: en last_updated: 2026-10-27 --- * [Home](https://www.acronis.com/en/tru/) * [Articles](https://www.acronis.com/en/tru/posts/) * [Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/) 01 July 2024 # Hunters International: New ransomware based on Hive source code Hunters International ransomware was first spotted in October 2023. While it shares many similarities with Hive ransomware, it is not a rebrand. But like Hive, Hunters International works as ransomware as a service (RaaS) and besides encryption, it also exfiltrates victim data. Author: **[Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/)** ## Summary ● Ransomware-as-a-service group. ● Reviewed sample is a PE64 file written in Rust. ● Requires username and password as command line arguments to start execution. ● Prevents backup and recovery. ● Terminates processes and services. ● Encrypts files using AES and RSA ciphers. ## Introduction Hunters International ransomware was first spotted in October 2023. While it shares many similarities with Hive ransomware, it is not a rebrand, as threat actors said. After the FBI defaced the Hive ransomware leak site, Hunters International sold older versions of their source code written in C and Golang, as well as their website. ![Image 1: Source: Hunters International data leak site](https://staticfiles.acronis.com/images/content/c2781f66db58ce89e2cbb0dc866bdf31.png) Source: Hunters International data leak site As Hunters International threat actors said, they took Hive encryption logic and fixed several issues that sometimes prevented file decryption. Similar to Hive, Hunters International works as ransomware as a service (RaaS) and besides encryption, it also exfiltrates victim data. ## Technical details ### Overview The analyzed sample is a PE64 file, written in Rust and designed as a GUI application. ![Image 2: Hunters International: New ransomware based on Hive source code](https://staticfiles.acronis.com/images/content/4ffa4cfa285d6100cb22b8bf76d064a4.png) ### Execution At the start of execution, the sample checks command line arguments. If no arguments were provided, execution would be immediately terminated. To begin execution, the ‘-c’ argument must be passed with credentials in the next format _“-c username:password”_. The username and password will later be written to the ransom note file as credentials to the threat actor chat site. Additionally, the folder path to encrypt can be given after ‘-c’ argument. After parsing commands, the sample starts creating encryption threads using Tokio asynchronous runtime for Rust. ![Image 3: Hunters International: New ransomware based on Hive source code](https://staticfiles.acronis.com/images/content/2315ace0b0451d1b9140125b5806b5ba.png) Next, it executes some commands to prevent backup and recovery: _vssadmin.exe delete shadows /all /quiet_ _wmic.exe shadowcopy delete_ _wbadmin.exe delete systemstatebackup_ _wbadmin.exe delete catalog-quiet_ _bcedit.exe /set {default} recoveryenabled No_ _bcedit.exe /set {default} bootstatuspolicy ignoreallfailures_ _wbadmin.exe delete systemstatebackup -keepVersion:3_ After obtaining ‘SE_DEBUG’ privilege, the sample takes a snapshot of all running processes using ‘CreateToolhelp32Snapshot;’ it then searches for ‘winlogon.exe’ process. After it has been found, the malware opens it and impersonates the token to escalate privileges and bypass access control. ![Image 4: Hunters International: New ransomware based on Hive source code](https://staticfiles.acronis.com/images/content/caf69547f640f6c2264f3933b107ed6a.png) The sample has a list that contains processes and services names: _firefox, memtas, mepocs, msmq, excel, backup, mspub, mssql, mysql, notepad, ocomm, ocssd, onenote, oracle, outlook, powerpnt, sql, sqbcoreservice, steam, svc$, thebat, thunderbird, veeam, visio, vmm, vmwp, vss, vssvc winword, wordpad, xfssvccon, dbsnmp, encsvc, agntsvc, bdeng50, dbsnmp_ This list is used in two functions. The first takes a snapshot of all running processes, and then using ‘Process32First’ and ‘Process32Next,’ loads the result to the Buf2 variable. It then enters a loop, where the found process name is compared with each item from the saved list and loaded to the Buf1 variable. If the found process name matches the list, it will be terminated. ![Image 5: Hunters International: New ransomware based on Hive source code](https://staticfiles.acronis.com/images/content/4cc4c760974f8ed36ed987d03cd2d853.png) The second function uses ‘OpenSCManagerW’ import to obtain all active service names on the system with ‘EnumServicesStatusW’ function. The sample then compares the list with its own list. When the match is found, the sample uses the ‘EnumDependentServicesA’ function to find all dependent services. All found services will be terminated. ![Image 6: Hunters International: New ransomware based on Hive source code](https://staticfiles.acronis.com/images/content/5f80371aef4ed0241c6a5306b9f898c7.png) While GUI applications don't have a console by default, the sample uses the ‘AttachConsole’ function to get the handle of the parent process console and print output to the parent process console. Besides executed commands and stopped processes, it outputs each processed file alongside with the time it took to encrypt it. ![Image 7: Hunters International: New ransomware based on Hive source code](https://staticfiles.acronis.com/images/content/e82d0f20a2cc51c694ffae935d8a0761.png) ### File encryption ‘GetLogicalDrivesStringsW’ is used to obtain all available drives on the system. Obtained names will be passed to the ‘GetDriveType’ function to discover their types. If the result value is less than 2(0 = DRIVE_UNKNOWN and 1 = DRIVE_NO_ROOT_DIR), the names will be skipped during encryption. ![Image 8: Hunters International: New ransomware based on Hive source code](https://staticfiles.acronis.com/images/content/7fc3871b5822e09066ecf110d3686126.png) Additionally, if network shares are present in the system, they also will be encrypted. All found drives will be passed to the loop, which uses ‘FindFirstFileW’ and ‘FindNextFileW’ functions. During encryption, the sample skips many different files and folders, mostly consisting of system files and programs, so as not to disrupt system workability and to allow contact with the threat actor. File names that are excluded from encryption: _Contact US.txt, autorun.inf, bootfont.bin, boot.ini, bootsect.bak, desktop.ini, iconcache.db, ntldr, NTUSER.DAT, NTUSER.DAT.LOG, Ntuser.ini, thumbs.db_ Directory names that will be skipped: _Windows, Program Files, Program Files (x86), Program Data, $Recycle.Bin, All Users, Default, Google, System Volume Information, Boot, Intel, Internet Explorer, PerfLogs_ Files extensions that must be skipped: _386, adv, ani, bat, bin, cab, cmd, com, cpl, cur, deskthemepack, diagcab, diagcfg, diagpkg, dll, drv, exe, hlp, hta, icl, icns, ico, ics, idx, key, ldf, lnk, lock, mod, mpa, msc, msi, msp, msstyles, msu, nls, nomedia, ocx, pdb, prf, ps1, rom, rtp, scr, shs, spl, sys, theme, themepack, tmp, wpx_ To encrypt file content, Hunters International uses AES cipher. Each thread generates encryption keys using the ‘BCryptGenRandom’ function. Encryption logic implementation uses AES hardware instructions set, which includes AESKEYGENASSIST, AESIMC, AESENC, AESENCLAST. ![Image 9: Hunters International: New ransomware based on Hive source code](https://staticfiles.acronis.com/images/content/23504a0ab2c500f84a37dcd72bd303e1.png) Note that in the earlier Hunters International samples, a ChaCha20-Poly1305 algorithm was used to encrypt file content. To protect encryption keys, the sample still uses RSA OAEP. It also uses a SHA3-256 Kecaak hash calculation function. ![Image 10: Hunters International: New ransomware based on Hive source code](https://staticfiles.acronis.com/images/content/e911008fbf56ec4d7605f609b6437caf.png) All encryption algorithms were taken from Crates.io web service for creating and searching different packages for Rust. ![Image 11: Hunters International: New ransomware based on Hive source code](https://staticfiles.acronis.com/images/content/907c433a306dde2430396f46c8abf288.png) Encrypted AES key will be appended to the end of each file, separated with 16 bytes of ‘0x00’. ![Image 12: Hunters International: New ransomware based on Hive source code](https://staticfiles.acronis.com/images/content/99900a395c0420b98bc11bd00d27792f.png) ### Free space eraser After the encryption process is done, the sample creates a ‘buffer.swp’ file on each encrypted drive and continuously writes 16,384 bytes of random data until there is no free space on the disk. Even if a particular folder was passed as an argument, the sample will still wipe free space. ![Image 13: Hunters International: New ransomware based on Hive source code](https://staticfiles.acronis.com/images/content/00cb9023bfa24e9f01d0694c36b0241e.png) ### Ransom note The ransom note is dropped in each encrypted folder on the system and automatically opened at the end of the encryption process. ![Image 14: Hunters International: New ransomware based on Hive source code](https://staticfiles.acronis.com/images/content/d7c421417266457ed2c064c4f8ddb9b1.png) ### Data leak site The data leak site contains the victims' names, their status, the deadline for paying the ransom and revenue value. Also, each company has tags that characterize data categories: _Encrypted Data, Private, Personally Identifiable Information, Financial Data, Customer Data, Passwords, Database, Technology, Governmental Data and Uncategorized._ ![Image 15: Hunters International: New ransomware based on Hive source code](https://staticfiles.acronis.com/images/content/4f298c2a308d35b4cdfe6f505871bac4.png) Victims without a ‘Private’ tag also have a proof page featuring some of the encrypted and stolen files where everyone can download them. ![Image 16: Hunters International: New ransomware based on Hive source code](https://staticfiles.acronis.com/images/content/9d5add341abae91ebf0c8e26f9b24c4c.png) The data leak site also contains a News page. The latest post, dated April 24, 2024 contains a link to the public domain site. This site is the same data leak site, but it can be accessed from any browser. ![Image 17: Hunters International: New ransomware based on Hive source code](https://staticfiles.acronis.com/images/content/108d39b7d57aae3e0b9b59395780b2fa.png) This public domain is registered in Russia with a fake identity using the NiceNIC domain service. In fact, this person (Mihail Kolesnikov) owns more than 400 domains. ![Image 18: Hunters International: New ransomware based on Hive source code](https://staticfiles.acronis.com/images/content/21daaf4238aa6651871dc02d3c33181e.png) Additional links from the ransom note lead to the chat with the threat actor. It requires a login and password from the ransom note to enter. ![Image 19: Hunters International: New ransomware based on Hive source code](https://staticfiles.acronis.com/images/content/f25d548f0ae413f7020698014d32a305.png) ## Conclusion Even though Hunters International group has taken the Hive ransomware source code as a base for their malware, they have improved some crucial mistakes in the encryption process. Considering that Hunters International works as ransomware as a service, we can expect a continuation and even an increasing number of attacks. Being written in Rust programming language, the malware uses different packages from the Crates.io site, which includes encryption logic, thread working and others. Combining AES and RSA ciphers makes file encryption strong, and data exfiltration is used to ensure that the victim will pay the ransom not only for decryption but also to prevent their data being sold on underground forums. ![Image 20: Hunters International: New ransomware based on Hive source code](https://staticfiles.acronis.com/images/content/6ac32d464d86f613c7b1732626b2d8dc.png) ![Image 21: Hunters International: New ransomware based on Hive source code](https://staticfiles.acronis.com/images/content/c3ab04fa03c50697499226c696ba8ee2.png) Related articles [The Gentlemen: A closer look at a not-so-gentle ransomware-as-a- service operation](https://www.acronis.com/en/tru/posts/the-gentlemen-a-closer-look-at-a-not-so-gentle-ransomware-as-a-service-operation/) [Acronis AI Copilot: Adoption is high and growing among MSPs](https://www.acronis.com/en/tru/posts/acronis-ai-copilot-adoption-is-high-and-growing-among-msps/) [Acronis Cyberthreats Update, October 2026](https://www.acronis.com/en/tru/posts/acronis-cyberthreats-update-october-2026/) [AI agents at work: What Acronis endpoint data reveals about MSP and SMB usage](https://www.acronis.com/en/tru/posts/ai-agents-at-work-what-acronis-endpoint-data-reveals-about-msp-and-smb-usage/)