After being shut down by the Federal Bureau of Investigation (FBI) and other international law enforcement agencies in January of 2023, the notorious Hive ransomware group appears to have sold their source code and infrastructure to a new ransomware group called Hunters International. The now-dismantled Hive Ransomware-as-a-Service (RaaS) operation had an estimated 1,500 targets worldwide, amassing upwards of $100 million in ransom payments and being known to target hospitals, school districts, and financial institutions since their founding in June of 2021. The threat actors associated with the emerging Hunters International have been working to dispel speculations about them being a rebrand of Hive, letting it be known that they purchased the source code and websites from the previous developers to benefit the kick-off of Hunters International’s own pursuits in the threat landscape business. Upon analyzing the group’s operations, researchers have found Hunters International’s ransomware code to be noticeably more simplistic, having “reduced the number of command line parameters, streamlined the encryption key storage process, and made the malware less verbose compared to earlier versions.” Having five (5) victims already, it appears that Hunters International is aligning themselves to be a more data exfiltration centric group with less of a focus on data encryption. While there’s a significant advantage to having a mature toolkit in their possession, it’s unclear what the future holds for Hunters International as well as whether they’ll be able to prove their competence. CTIX analysts will continue to monitor relevant threat actor developments and provide updates as operations evolve.