🎯 WorldLeaks — Pure Extortion Campaign

Category: Data Exfiltration | Severity: 🔴 Critical | Focus: Incident Response

---

📋 Executive Summary

This scenario simulates a full-chain WorldLeaks (ex-Hunters International) pure extortion attack, based on the SOSRansomware threat intelligence report and corroborated by Group-IB and Lexfo Security research.

WorldLeaks represents the evolution of Hunters International, which itself emerged from Hive ransomware's infrastructure. In January 2025, the group pivoted from traditional double extortion (encrypt + leak) to pure extortion only — stealing data without encrypting systems. This scenario reproduces their exact TTP chain, from initial access via spearphishing to data exfiltration using Rclone, with emphasis on the collection and exfiltration phases that define their operational model.

---

🧠 Threat Actor Profile

Attribute	Details
Name	WorldLeaks (formerly Hunters International, Hive lineage)
Active Since	January 2025 (rebrand from Hunters International)
Model	Pure extortion — data theft without encryption
Infrastructure	4-tier architecture: Storage Software → Automation Server → Proxy Layer → Victim Network
Notable Victims	Dell (1.3TB / 416,103 files), L3Harris, Tata Technologies
Recruitment	Actively recruits affiliates on underground forums

IOCs Referenced

IOC	Type	Context
6a9c0f3f2c7d9e9fd2e33e71b91d5e5f6cbd27ef	SHA-1	Custom exfiltration tool binary
e4c1a3e345a2f5d872ea04cd1fd3a7725b927ffa	SHA-1	Vulnerable kernel driver (BYOVD)
185.217.69.101	IPv4	C2 infrastructure (not used in payloads — safe-by-design)
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\wldboot	Registry Key	Persistence mechanism

---

🔗 Kill Chain — 10 Injects

Stage 1 — Initial Access: Spearphishing Macro Execution

ATT&CK	T1566.001 — Phishing: Spearphishing Attachment
Delay	T+0s (scenario start)
Description	Simulates the delivery of a weaponized Office document containing a VBA macro. WorldLeaks affiliates commonly use spearphishing emails with macro-enabled attachments (.xlsm, .docm) as the initial compromise vector. The macro establishes initial code execution on the victim endpoint.
What it does	Drops and executes a simulated macro payload, generating process creation artifacts consistent with Office child process spawning (winword.exe → cmd.exe/powershell.exe).
Detection opportunities	Office application spawning child processes, VBA macro execution events, suspicious file writes from Office processes.

---

Stage 2 — Execution: Encoded PowerShell Stager

ATT&CK	T1059.001 — Command and Scripting Interpreter: PowerShell
Delay	T+2min
Description	Following initial macro execution, WorldLeaks deploys an encoded PowerShell stager to establish a foothold. Base64-encoded commands are used to evade basic command-line logging and static detection rules.
What it does	Executes a Base64-encoded PowerShell command that performs reconnaissance and establishes persistence artifacts. This mirrors the real-world technique where WorldLeaks uses -EncodedCommand to bypass AMSI and script block logging.
Detection opportunities	PowerShell with -EncodedCommand flag, suspicious Base64 strings in command line, ScriptBlock logging events (Event ID 4104).

---

Stage 3 — Discovery: System & Network Reconnaissance

ATT&CK	T1082 — System Information Discovery / T1135 — Network Share Discovery
Delay	T+4min
Description	WorldLeaks operators perform extensive reconnaissance to identify high-value data stores before exfiltration. This includes system profiling, network share enumeration, and identification of accessible file servers — critical for their pure extortion model where data selection directly impacts ransom leverage.
What it does	Executes native Windows commands (systeminfo, net share, net view, ipconfig /all) to enumerate the local system and network topology. Results are collected for operator review.
Detection opportunities	Rapid succession of discovery commands, net.exe/net1.exe execution, unusual enumeration patterns from a single endpoint.

---

Stage 4 — Discovery: Security Software Discovery

ATT&CK	T1057 — Process Discovery
Delay	T+6min
Description	Before escalating privileges and moving laterally, WorldLeaks operators enumerate running security products to tailor their evasion techniques. Identifying EDR agents, antivirus solutions, and monitoring tools allows them to select the appropriate defense evasion strategy for the target environment.
What it does	Enumerates running processes and installed services to identify security software (EDR agents, AV products, SIEM collectors). Uses native Windows commands and WMI queries.
Detection opportunities	WMI queries targeting AntiVirusProduct class, process enumeration focused on security tools, tasklist / Get-Process with filtering patterns.

---

Stage 5 — Credential Access: LSASS Credential Dump (ProcDump)

ATT&CK	T1003.001 — OS Credential Dumping: LSASS Memory
Delay	T+8min
Description	WorldLeaks operators dump LSASS process memory to extract plaintext credentials, NTLM hashes, and Kerberos tickets. ProcDump (a legitimate Sysinternals tool) is used to create the memory dump, reducing detection surface compared to tools like Mimikatz. This technique was specifically observed in Hunters International / WorldLeaks campaigns.
What it does	Downloads ProcDump (with prerequisite check), creates a memory dump of the LSASS process. The dump file is written to a controlled artifact directory and cleaned up after execution.
Detection opportunities	Access to LSASS process memory (Sysmon Event ID 10), ProcDump execution with -ma flag targeting lsass.exe, suspicious .dmp file creation, credential guard alerts.

---

Stage 6 — Defense Evasion: Disable Windows Event Logging

ATT&CK	T1562.002 — Impair Defenses: Disable Windows Event Logging
Delay	T+10min
Description	Before proceeding to lateral movement and data collection, WorldLeaks operators disable or tamper with Windows event logging to blind SIEM and forensic analysis. This is a critical step in their operational playbook — reducing the evidence trail makes post-incident investigation significantly harder, increasing pressure on victims to pay the ransom rather than attempt recovery.
What it does	Disables Windows event logging services with state backup for cleanup restoration. All original settings are saved and restored during cleanup.
Detection opportunities	Event log service stop events (Event ID 1100/1102), wevtutil commands, security audit policy changes, gaps in event log continuity.

---

Stage 7 — Persistence: Scheduled Task

ATT&CK	T1053.005 — Scheduled Task/Job: Scheduled Task
Delay	T+12min
Description	WorldLeaks establishes persistence via scheduled tasks to maintain access across reboots. The IOC HKCU\Software\Microsoft\Windows\CurrentVersion\Run\wldboot from threat intelligence indicates they also use Run Keys, but scheduled tasks provide more flexible execution options and can be configured with specific triggers (logon, idle, time-based). This ensures the operator can return to the compromised environment if the initial access channel is lost.
What it does	Creates a scheduled task that simulates WorldLeaks persistence. The task is fully removed during cleanup — no durable attacker capability is left behind.
Detection opportunities	schtasks.exe /create, Event ID 4698 (Scheduled task created), new task entries in C:\Windows\System32\Tasks\, suspicious task actions pointing to PowerShell or cmd.exe.

---

🎯 Stage 8 — Collection: Sensitive Data Harvesting

ATT&CK	T1039 — Data from Network Shared Drive / T1074.001 — Data Staged: Local Data Staging
Delay	T+14min
Description	Core WorldLeaks TTP. Operators systematically harvest sensitive data from network shares and local repositories. In the Dell breach, WorldLeaks exfiltrated 1.3TB across 416,103 files. Their custom "Storage Software" component automates file discovery and collection based on file type, size, and path patterns — prioritizing financial documents, intellectual property, HR records, and customer data for maximum extortion leverage.
What it does	Discovers and catalogs files matching sensitive patterns across accessible storage locations. Uses parameterized OpenAEV arguments for target paths — no hardcoded hostnames or shares.
Detection opportunities	Unusual file access patterns (bulk reads), enumeration of multiple network shares in rapid succession, file metadata collection activity, staging directory creation.

---

🎯 Stage 9 — Archive: Data Staging & Compression

ATT&CK	T1560.001 — Archive Collected Data: Archive via Utility
Delay	T+16min
Description	Core WorldLeaks TTP. Before exfiltration, collected data is compressed into password-protected archives. This serves dual purposes: reducing transfer volume and evading DLP/content inspection systems that cannot examine encrypted archives. In the Dell breach, WorldLeaks compressed 1.3TB of data before exfiltration through their proxy infrastructure.
What it does	Compresses target files into a password-protected archive. The payload uses OpenAEV arguments for target paths and passwords — nothing is hardcoded. Full cleanup removes the archiving tool and all archive artifacts.
Detection opportunities	Archive utility execution with password flag (-p), large archive creation, unusual compression activity from non-standard paths, file access patterns indicating bulk data collection.

---

🎯 Stage 10 — Exfiltration: Rclone Cloud Upload

ATT&CK	T1567 — Exfiltration Over Web Service
Delay	T+18min
Description	Signature WorldLeaks technique. The group uses Rclone — a legitimate cloud synchronization tool — to exfiltrate archived data to attacker-controlled cloud storage. Rclone supports 40+ cloud providers, making it extremely versatile for data theft. WorldLeaks' 4-tier infrastructure routes exfiltrated data through proxy layers to their Storage Software servers. This is the culmination of the pure extortion model: steal, don't encrypt.
What it does	Downloads Rclone (with prerequisite check), creates a configuration pointing to a non-existent endpoint (safe-by-design — no actual data leaves the network), and executes the upload command. The payload generates all the process creation, network connection, and configuration artifacts that a real Rclone exfiltration would produce. Full cleanup removes Rclone, config files, and all artifacts.
Detection opportunities	rclone.exe process execution, Rclone configuration file creation (rclone.conf), outbound HTTPS connections to cloud storage APIs, large outbound data transfers, DNS queries to cloud provider domains, command-line arguments containing copy or sync with remote paths.

---

🔒 Security Checklist

Criterion	Status
No C2 / reverse shell / beacon	✅ All traffic stays local or targets non-existent endpoints
No real malware / ransomware binaries	✅ Only native Windows tools + legitimate utilities
No actual data exfiltration	✅ Rclone targets a non-routable/non-existent endpoint
Cleanup removes all artifacts	✅ Dumps, archives, logs, tools all cleaned
Cleanup removes persistence	✅ Scheduled tasks deleted
Cleanup restores security settings	✅ Event logging state restored from backup
ATT&CK mapping on every inject	✅ 10 techniques mapped across 7 tactics
No hardcoded hostnames/IPs	✅ OpenAEV arguments used for parameterization
Uses existing verified payloads	✅ No custom "bullshit" payloads — all from verified library

---

📊 Value Proposition

1. Source-driven realism — Every stage maps directly to WorldLeaks TTPs documented in the SOSRansomware report, Group-IB research, and Lexfo Security analysis
2. Exfiltration emphasis — Stages 8-10 specifically reproduce WorldLeaks' pure extortion model (collect → archive → exfiltrate), differentiating them from traditional ransomware groups
3. Detection validation — Each inject generates real artifacts (process creation, file system, registry, network) that validate EDR/SIEM detection rules
4. Safe-by-design — Full execution on production-like environments without risk: no real C2, no real exfiltration, complete cleanup
5. Parameterized payloads — OpenAEV arguments allow customization per environment without modifying payload code
6. Complete kill chain coverage — 10 ATT&CK techniques across 7 tactics, providing comprehensive detection gap analysis

---

Total execution time: ~18 minutes | 10 injects | 10 ATT&CK techniques | 7 tactics covered