Worldleaks

☆ pin

Also known as World Leaks, Hunters International spin-off, Hunters International

Reports

First seen

May 11, 2026

Last seen

Jul 21, 2026

Motivation

Financial

Relationships

Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.

Targeting

Sectors

Manufacturing ×9 Energy & Utilities ×2 Financial Services ×2 Healthcare ×2 Professional Services ×1 Transport & Logistics ×1 Retail & E-commerce ×1 Education ×1

Victim regions

×1

×7

India×7

United States×5

Canada×1

Thailand×1

Pakistan×1

Italy×1

Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.

Top ATT&CK techniques

T1566 Phishing ×4T1190 Exploit Public-Facing Application ×4T1005 Data from Local System ×3T1059 Command and Scripting Interpreter ×2T1110 Brute Force ×1T1056 Input Capture ×1T1486 Data Encrypted for Impact ×1T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage ×1T1204 User Execution ×1T1047 Windows Management Instrumentation ×1T1537 Transfer Data to Cloud Account ×1T1592 Gather Victim Identity Information ×1

Indicators

cve ×49domain ×48ip_v4 ×17hash_sha256 ×3hash_md5 ×2filename ×2hash_sha1 ×1

Indicator values are available on Pro and via the API.

Recent reports

High

Worldleaks

Relationships

Targeting

Top ATT&CK techniques

Indicators

Associated CVEs

Recent reports

Worldleaks publishes St. Francis Xavier Catholic School System breach

Worldleaks publishes PinnPACK as ransomware victim

India dismisses leaked Kudankulam nuclear plant files as non-critical after World Leaks disclosure

Weekly Recap: WordPress RCE, SonicWall 0-Days, AI Service Attacks, SharePoint 0-Day

Worldleaks publishes Service IT as new victim

Worldleaks publishes Treet Group of Companies as ransomware victim

Worldleaks claims new victim: Starpool

Worldleaks publishes new victim: COMHAR

Threat Intelligence Report – 29 June: Breaches, AI Threats, and Active Exploits

Tata Electronics confirms cyberattack; World Leaks group claims stolen Apple manufacturing data

Tata Electronics confirms cyberattack after World Leaks publishes alleged Apple, Tesla documents

Worldleaks publishes L'Archevque & Rivest Ltée as ransomware victim

Worldleaks publishes Super Finishing as ransomware victim

Worldleaks publishes Reliance Group as ransomware victim

Worldleaks publishes Tata Electronics as ransomware victim

Worldleaks publishes First Federal Savings & Loan as ransomware victim

Worldleaks claims Centra Sota Cooperative ransom victim

Worldleaks publishes Apollo Pipes as new ransomware victim

Worldleaks publishes GDL Transport as ransomware victim

Worldleaks publishes M1xchange (Indian trade receivables platform) as ransomware victim

Worldleaks publishes Access Dental as ransomware victim

Worldleaks publishes United Auto Supply as new victim

Worldleaks publishes CH Karnchang Public as ransomware victim

Worldleaks ransomware gang publishes American Battery Factory as victim

Worldleaks publishes BMJ Paperpack as ransomware victim

Worldleaks claims Bestat Pharmaservices Corp victim

Check Point Research Threat Intelligence Report – 11 May