Hunters International ransomware is believed to have first been discovered in October 2023 and operates using a Ransomware as a Service (RaaS) model. It is thought to share similarities with the Hive ransomware in the past. The sample provided for technical analysis is written in Rust.

The ransomware utilizes sophisticated techniques, including execution via command-line arguments and ongoing operations based on disk, system, service, and process controls. It generates random AES keys and subsequently encrypts them with an RSA public key. After encrypting the files, it appends the “.locked” extension to the affected files. Additionally, it creates a “Contact Us.txt” file containing credentials that allow the threat actor to communicate effectively with the victims.