• World Leaks emerged in early 2025 as a new project by the operators of the Hunters International ransomware group, shifting from double extortion with ransomware to extortion-only attacks due to increased risks and reduced profitability.
• The World Leaks and Hunters International platforms share numerous similarities in design, layout, and functionality.
• World Leaks operates four distinct platforms: a main data leak site, a negotiation site for ransom payments, an Insider platform for journalists, and an affiliate panel.
• World Leaks faced initial bugs, downtime, and fluctuations in claimed data leak sizes, raising questions about data accuracy.
• Despite claiming to be extortion-only, some victims suffered ransomware deployment.
• We learned that the Secp0 ransomware group is collaborating with World Leaks, indicating potential future attractiveness for other threat actors.

The Hunters International ransomware group is targeting IT workers with a new C# remote access trojan (RAT) called SharpRhino to breach corporate networks.

During a recent ransomware incident investigated by the Quorum Cyber Incident Response team, novel malware was identified previously unknown.

On October 17, the FBI issued a Public Service Announcement, Cybercriminals are Targeting Plastic Surgery Offices and Patients. Five days later, DataBreaches learned that there had been another attack on a plastic surgery practice where patient data had allegedly been stolen and is in danger of being leaked publicly. It would not be surprising if the FBI knew about the attack and that it was the impetus for the newly released PSA.