World Leaks
A data extortion operation launched in early 2025, which Group-IB links to the operators of Hunters International. It says it steals data without encrypting it, but Darktrace reported encryption in a January 2026 case, so organisations should not assume systems will stay available.
Threat actor profile. Last reviewed 3 November 2026.
Why It Matters
Group-IB says the Hunters International operators released World Leaks on 1 January 2025 because, from the administrator's view, ransomware was no longer profitable and was too risky. The operation gives affiliates an automated data theft tool.1,2 SecurityWeek reported that the project was paused soon after release to fix infrastructure problems.2
The extortion-only label should not be taken at face value. Darktrace investigated a January 2026 healthcare intrusion attributed to World Leaks that ended in encryption, after about three months of suspected presence.4 Blackpoint also notes some incidents involving encryption.5
In February 2026, Accenture research revealed RustyRocket, a Rust tool for Windows and Linux that moves stolen data through layered encrypted tunnels designed to blend with normal traffic.3 Darktrace says victims are mostly in the US, with others in Canada and Europe.4 The sources reviewed do not establish a UK link.
Data theft takes time, and the Darktrace case suggests months of warning were available. We would look at outbound volume and tunnelling tools as well as encryption alerts, and keep recovery plans in place despite the group's extortion-only claim.
How It Attacks
Based mainly on Darktrace's January 2026 case,4 with tooling from Accenture's research.3 One case is not a fixed script.
- 1
Get In
Likely entered through a FortiGate appliance after brute force activity using a compromised administrator credential. Other reports cite stolen credentials, exposed services and social engineering.
- 2
Wait and Explore
Scans for open ports and remains on the network, around three months in the Darktrace case.
- 3
Move Laterally
Uses PsExec, SMB transfers, WinRM, RDP and Chrome Remote Desktop.
- 4
Tunnel Out
Uses Cloudflare Tunnel, a suspected OpenVPN link and SSH to reach external hosts.
- 5
Steal the Data
Sends data to MEGA and Backblaze, with Rclone seen in transfers. RustyRocket is reported in other work.
- 6
Extort, and Sometimes Encrypt
Threatens publication on its leak site. In the Darktrace case, ransomware was delivered over SMB with a ransom note.
Key Techniques
ATT&CK v20 has no group entry for World Leaks. This mapping is ours, based on Darktrace4 and Accenture's research as reported.3
| ID | Technique | Tactic | What It Looks Like |
|---|---|---|---|
| T1110 | Brute Force | Credential Access | Brute force activity against a FortiGate appliance. |
| T1078 | Valid Accounts | Initial Access | Uses compromised administrator and local admin credentials. |
| T1021.002 | SMB/Windows Admin Shares | Lateral Movement | Moves files and payloads over SMB. |
| T1021.006 | Windows Remote Management | Lateral Movement | Uses WinRM between hosts. |
| T1219.002 | Remote Desktop Software | Command and Control | Has used Chrome Remote Desktop. |
| T1572 | Protocol Tunneling | Command and Control | Tunnels traffic through Cloudflare Tunnel. |
| T1567.002 | Exfiltration to Cloud Storage | Exfiltration | Sends data to MEGA and Backblaze. |
| T1486 | Data Encrypted for Impact | Impact | Encryption reported in at least one case. |
Tools Observed
Custom Tools
Remote Access and Tunnelling
Data Theft
From Darktrace4 and Accenture's research as reported by Infosecurity Magazine.3 Many are legitimate, so check whether use is approved and expected.
Vulnerabilities
The sources reviewed tie no specific CVE to World Leaks.5
Warning Signs
Drawn from Darktrace4 and Accenture's advice.3 None of these proves an attack alone.
- Brute force activity against firewall or VPN administrator accounts
- Rclone in the user agent of outbound transfers
- Large uploads to MEGA or Backblaze from servers
- Cloudflare Tunnel or unexpected SSH to external hosts
- Anomalous outbound data transfers
Defences That Matter
Protect the Edge
- Require MFA on VPN and firewall administration, as weak VPN authentication is a reported way in.5
- Review administrator accounts on edge appliances.
Watch What Leaves
- Monitor for anomalous outbound transfers.3
- Restrict unapproved cloud storage and tunnelling tools.
Limit the Spread
Red and purple teamingPrepare for Both Outcomes
- Plan for publication threats and for encryption, given the Darktrace case.4
Would You Notice Data Leaving Before the Ransom Note?
We can test your detection and data controls against the methods in this profile and help you close the gaps.
Sources
- BleepingComputer: Hunters International shifts from ransomware to pure data extortion, 3 April 2025
- SecurityWeek: Hunters International Ransomware Gang Rebranding, Shifting Focus, April 2025
- Infosecurity Magazine: World Leaks Ransomware Group Adds Stealthy, Custom Malware 'RustyRocket' to Attacks, 12 February 2026
- Darktrace: When Reality Diverges from the Playbook: Darktrace Identifies Encryption in a World Leaks Ransomware Attack, 17 March 2026
- Blackpoint Cyber: World Leaks threat profile, 17 December 2025
MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK terms of use.