Signalis
sign in--:--:--UTC
Threat actors

Worldleaks

Also known as Hunters International
Reports
18
First seen
May 11
Last seen
Jun 23
Motivation
extortion, financial extortion, financial

Targeting

Sectors
manufacturing ×7financial services ×2healthcare ×2professional services ×1energy utilities ×1agriculture ×1transportation logistics ×1retail ecommerce ×1
Victim regions
India ×6United States ×4Canada ×1Thailand ×1

Top ATT&CK techniques

T1566 Phishing ×1T1056 Input Capture ×1T1005 Data from Local System ×1T1187 Forced Authentication ×1T1053 Scheduled Task/Job ×1T1567 Exfiltration Over Web Service ×1T1190 Exploit Public-Facing Application ×1T1598 Phishing for Information ×1T1059 Command and Scripting Interpreter ×1

Indicators

domain ×33ip_v4 ×14cve ×4hash_md5 ×2hash_sha256 ×2hash_sha1 ×1

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2026-0300 (exploited)CVE-2026-4670CVE-2026-5174CVE-2026-6973 (exploited)

Recent reports

High

Tata Electronics confirms cyberattack; World Leaks group claims stolen Apple manufacturing data

Bleeping ComputerHigh

Tata Electronics confirms cyberattack after World Leaks publishes alleged Apple, Tesla documents

The Record (Recorded Future News)High

Worldleaks publishes L'Archevque & Rivest Ltée as ransomware victim

ransomware.liveHigh

Worldleaks publishes Super Finishing as ransomware victim

ransomware.liveHigh

Worldleaks publishes Reliance Group as ransomware victim

ransomware.liveHigh

Worldleaks publishes Tata Electronics as ransomware victim

ransomware.liveHigh

Worldleaks publishes First Federal Savings & Loan as ransomware victim

ransomware.liveHigh

Worldleaks claims Centra Sota Cooperative ransom victim

ransomware.liveHigh

Worldleaks publishes Apollo Pipes as new ransomware victim

ransomware.liveHigh

Worldleaks publishes GDL Transport as ransomware victim

ransomware.liveHigh

Worldleaks publishes M1xchange (Indian trade receivables platform) as ransomware victim

ransomware.liveHigh

Worldleaks publishes Access Dental as ransomware victim

ransomware.liveHigh

Worldleaks publishes United Auto Supply as new victim

ransomware.liveHigh

Worldleaks publishes CH Karnchang Public as ransomware victim

ransomware.liveHigh

Worldleaks ransomware gang publishes American Battery Factory as victim

ransomware.liveHigh

Worldleaks publishes BMJ Paperpack as ransomware victim

ransomware.liveHigh

Worldleaks claims Bestat Pharmaservices Corp victim

ransomware.liveunrated

Check Point Research Threat Intelligence Report – 11 May

Check Point Research

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.

Sign upSee plans