Hunters International

┌──────────────────────────────────────────────────────┐
│           Hive → Hunters International 继承链          │
├──────────────────────────────────────────────────────┤
│                                                        │
│  Hive（2021-2023.01）                                 │
│  ├── 2023.01 FBI 秘密渗透瓦解                          │
│  ├── 获取 300+ 解密密钥                                │
│  │                                                      │
│  └──→ Hunters International（2023年初出现）            │
│       ├── ≥60% 代码重合                                │
│       ├── 继承 Hive 基础设施和谈判流程                  │
│       ├── Rust 重写加密器                              │
│       ├── ChaCha20-Poly1305 + RSA OAEP                │
│       │                                                │
│       └──→ World Leaks（2025.07 转型）                │
│            纯数据窃取模式，放弃加密                    │
│                                                        │
└──────────────────────────────────────────────────────┘

漏洞利用（FortiOS/WebLogic）/ 钓鱼 / IAB 购买
    ↓
SharpRhino RAT（持久化 C2）
    ↓
Mimikatz / DCSync（凭证窃取）
    ↓
RDP / SMB / PsExec（横向移动）
    ↓
Rclone / Mega（数据外传）
    ↓
Hunters International 载荷（Rust ChaCha20-Poly1305 + RSA OAEP 加密）
    ↓
World Leaks（纯数据窃取模式，2025.07后）

title: Hunters International - Volume Shadow Copy Deletion
id: hi001-vss-deletion
status: experimental
description: 检测 Hunters International 删除卷影副本的行为
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - 'vssadmin'
      - 'delete'
      - 'shadows'
  condition: selection
level: high
tags:
  - attack.defense_evasion
  - attack.t1490

title: Hunters International - SharpRhino RAT Detection
id: hi002-sharprhino
status: experimental
description: 检测 SharpRhino RAT 的异常行为
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\services.exe'
    CommandLine|contains: 'SharpRhino'
  condition: selection
level: critical
tags:
  - attack.execution
  - attack.t1059

title: Hunters International - FortiOS CVE-2024-55591 Exploitation
id: hi003-fortios
status: experimental
description: 检测 FortiOS CVE-2024-55591 漏洞利用行为
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\fortisslvpn.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
  condition: selection
level: critical
tags:
  - attack.initial_access
  - attack.t1190

rule Hunters_International_Ransomware {
    meta:
        description = "检测 Hunters International 勒索软件载荷"
        author = "Threat Intelligence Team"
        date = "2026-07-01"
        reference = "Hive successor"
    strings:
        $s1 = ".hunters" ascii
        $s2 = "Hunters International" ascii
        $s3 = "SharpRhino" ascii
        $s4 = "vssadmin delete shadows" ascii
        $s5 = "ChaCha20" ascii
        $hex1 = { 48 89 5C 24 08 48 89 6C 24 10 48 89 74 24 18 }
    condition:
        3 of ($s*) and $hex1
}