Leak Site Tied to Scattered Spider Seized by FBI and French Police

In a coordinated effort, the FBI and French National Police have seized the dark web leak site known as “Hunters.” Believed to be operated by the cybercriminal syndicate known as Scattered Spider (also tracked as UNC3944), this platform was central to the group’s extortion tactics.

The seizure notice now replaces the original leak page on the dark web, confirming the takedown. The message, jointly signed by the FBI and French authorities, signifies yet another global push against cybercriminal infrastructure.

A Primary Weapon in Ransomware Operations

The ‘Hunters’ site functioned as a dumping ground for stolen corporate data, often acquired during double extortion ransomware attacks. Victims would be coerced into paying ransoms to prevent public exposure of sensitive data.

Scattered Spider has long relied on such platforms to pressure enterprises into submission, combining social engineering, phishing, and data theft to compromise organizations.

Link to Major Attacks and Tactics

Scattered Spider is known for targeting large enterprises, including telecom, insurance, and tech firms. Their operations frequently use SIM-swapping, MFA fatigue attacks, and domain hijacking to penetrate high-value environments.

Security analysts noted that the group leveraged this leak site to amplify their psychological impact threatening to expose victims on a public stage unless payments were made.

Site Now Offline With Official Law Enforcement Notice

Currently, the Hunters domain is inaccessible and shows a seizure banner indicating the joint operation between the FBI’s Cyber Division and France’s Direction Centrale de la Police Judiciaire (DCPJ).

Digital forensics experts believe the operation involved extensive monitoring and coordination with international partners.

Potential Future Impact on the Threat Group

Although seizure of a leak site doesn’t eliminate the group itself, it does degrade their ability to intimidate victims and control the extortion narrative. Cybercrime groups often operate multiple leak sites, but this takedown sends a clear warning.

Moreover, the removal may force Scattered Spider to rebuild infrastructure under heightened scrutiny, reducing operational fluidity.

Continued International Crackdowns

This move follows a series of law enforcement actions against ransomware operations. Recent efforts have targeted infrastructure linked to LockBit, Hive, and Ragnar Locker. It reflects an evolving strategy to go beyond arrests and dismantle the technical backbone of cybercriminals.

Security Recommendations for Enterprises

• Implement strong MFA: Avoid legacy MFA methods vulnerable to fatigue or SIM swap.

• Monitor for leaked credentials: Use threat intel platforms to track dark web exposure.

• Update incident response plans: Ensure preparedness for extortion tactics and leak site threats.

• Enable DNS monitoring to identify connections to known dark web endpoints.

Organizations should view this as a sign to review their security posture. The focus of attackers is shifting from encryption to exposure.

FAQs

What was the Hunters leak site used for?
The Hunters site served as a platform to publicly leak data stolen during ransomware attacks by Scattered Spider, pressuring victims to pay.

Who took down the Hunters leak site?
The FBI and French National Police conducted a joint seizure of the domain as part of a larger cybercrime takedown initiative.

Is Scattered Spider still active?
While the leak site has been seized, the group may continue operations. However, the disruption significantly hampers their extortion capability.

What companies were affected by this group?
Scattered Spider has previously targeted telecoms, insurance providers, and other major enterprises, though specific names were often kept confidential.

Can leak sites be rebuilt by ransomware gangs?
Yes, but doing so under active law enforcement monitoring increases operational risk for threat actors and reduces their agility.