Hunters International attacks City of St. Cloud, Florida

Incident Date:

April 16, 2024

World map

Overview

Title

Hunters International attacks City of St. Cloud, Florida

Victim

City of St. Cloud, Florida

Attacker

Hunters International

Location

St Cloud, USA

Florida, USA

First Reported

April 16, 2024

Ransomware Gang Hunters International Targets City of St. Cloud, Florida

Data Leak and Impact

Ransomware gang Hunters International has just added the City of St. Cloud in Florida to its data leak site. On its site, the group claims to have stolen 1.4 TB of data, which includes 719,597 files. The city says it is working to resume normal operations as quickly as possible.

About City of St. Cloud, Florida

The City of St. Cloud, Florida, is a family-oriented community offering small-town charm in a location close to Orlando, Orlando International Airport, and Medical City in Lake Nona. This Soldier City has a strong sense of pride in its heritage, which is demonstrated through landmark areas, such as Veteran’s Park. Down the street, a state-of-the-art City Hall building complements the downtown area, which is filled with shops dotting its streets that are named after states, including New York, Pennsylvania, and Massachusetts.

Hunters International Background

Hunters International, a Ransomware-as-a-Service (RaaS) group, emerged in Q3 of 2023 after the discovery of source code bearing resemblances to the infamous Hive ransomware strain. In October 2023, a security researcher's analysis of the ransomware used by Hunters revealed significant code overlaps with Hive ransomware. Subsequent analysis by Bitdefender came to the same findings, leading researchers to conclude that Hive operators have handed off their malicious tool to another threat actor. Despite this, Hunters International has denied any ties to the Hive operation.

Intelligence suggests that Hunters International ransomware primarily aims to exfiltrate target data and extort victims with ransom demands for its return. One reported incident involved a plastic surgery clinic in the US, where approximately 248,000 files, including patient names and addresses, were exfiltrated. The ransomware encrypts files with the ".LOCKED" extension and leaves "Contact Us.txt" files in directories, instructing victims on how to initiate negotiation on the dark web. Successful exploitation by Hunters International typically results in significant data exfiltration prior to issuing a ransom demand, often tailored to the perceived value of the compromised organization.

Recent Ransomware Attacks

The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.

The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.