Threat Intelligence Tarot
Vol. II · 137
Criminal (Hive-derived)
★★★★★
risk 4/5
✦ The Inheritor ✦
Hunters International
Hive successor · World Leaks
HealthcareManufacturingTechnologyCritical sectors globally
Active since ~2023 · Extortion, Financial gain
The Inheritor wears Hive's coat with the embroidery picked off. The seams are still visible if you know where to look — and the police that disrupted the original have a head start on the heir.
Tactics & Techniques
RCN
RDV
INI
EXC
PRS
PRV
EVA
CRD
DSC
LAT
COL
C2
EXF
IMP
Notable Operations
- ◆Code reuse from disbanded Hive ransomware operation
- ◆Tata Technologies breach (early 2025)
- ◆Pivot to data-extortion-only branding as 'World Leaks' (2024)
- ◆Healthcare and manufacturing pattern matching pre-takedown Hive
Defenses
- ▸Ransomware family lineage tracking via shared signature huntingMITRE D3FEND
- ▸Decryption tool monitoring (No More Ransom project, FBI releases)NIST CSF: RC.RP ↗
- ▸Immutable backups tested with full-environment restoresCIS Control 11 ↗
- ▸Threat intelligence subscription tracking RaaS rebrandsNIST CSF: ID.RA ↗
Reversed: Their Weakness
Decryptor releases tied to law enforcement disruptions (Hive, LockBit) create downstream weakness in inherited code. Defenders who treat lineage-aware detection as a primary signal often catch the heir on day one.
Share this adversary profile
Compare →swipe to browse
Related Adversaries
Data sourced from MITRE ATT&CK. For educational purposes.