RustyRocket
IOCs & detection

World Leaks significantly expands RustyRocket into a platform for modern extortion operations

What's new

• Accenture Cyber Intelligence has identified a significant evolution in RustyRocket, a modular malware toolset linked to affiliates of the cyber extortion group World Leaks. It has matured from a targeted exfiltration utility into a scalable, enterprise-grade extortion platform.
• The toolset now features layered command-and-control architecture, cross-platform capability, and industrialized deployment workflows that rival the sophistication of legitimate software operations.
• In response, Accenture Cyber Intelligence is working to help clients identify RustyRocket's distinct network fingerprints across enterprise environments through new, innovative detection and hunt techniques.

In February of this year, Accenture Cyber Intelligence released research on a novel ransomware toolset from World Leaks called “RustyRocket” that quietly steals data to extort organizations. In the four months since that post, WorldLeaks has since skyrocketed their development of the tool.

What began as a narrowly-focused stealth exfiltration tool linked to WorldLeaks affiliates has been quietly and rapidly transformed into something far more concerning: a mature, modular, continuously-developed platform that is purpose-built for modern extortion operations. It now serves as a primary instrument for WorldLeaks to effectively attack and coerce organizations into paying a ransom. The implications for enterprise leaders are significant.

From toolset to platform

The clearest signal of the toolset’s development is the breadth of RustyRocket's current architecture. The malware now comprises an agent, proxy, and service launcher, creating a full ecosystem designed to establish and maintain access at scale. Think of it as a one-stop-shop for WorldLeaks to conduct their theft.

RustyRocket operates across Windows and Linux. In Windows environments, it can be deployed as a privileged, persistent service, enhancing both its resilience and operational capabilities. This means that RustyRocket can now move more easily across enterprise systems, run with greater authority, and stay hidden longer before defenders notice.

Perhaps most telling is the evidence of disciplined, ongoing development. Accenture Cyber Intelligence’s analysis of samples compiled over the last 18 months shows continuous refinement, testing of features, and streamlining of command sets from six to four. That's not the behavior of a one-and-done toolset. That's a development roadmap. The adversaries behind RustyRocket are investing in it in the same way legitimate software organizations invest in their products.

The command-and-control problem

Where RustyRocket gets truly sophisticated is in how it communicates and hides in plain sight. Recently, the tool’s stealth tactics have been carefully updated to disguise RustyRocket’s activities as legitimate network traffic and pivot if security teams are on its trail. For example, the malware now combines outer TLS encryption, inner mutual TLS tunnels, and custom multiplexed protocols, all within a single connection, to wrap its communications in multiple layers of encryption. On top of that, it can dynamically switch communication methods and leverage dynamic domain discovery to fall back to alternate infrastructure when needed.

For defenders, this is the crux of the challenge. Encrypted traffic is difficult to inspect and address. Layered, dynamic, protocol-blending encrypted traffic is even more difficult. That’s exactly what WorldLeaks wants. With all the new features WorldLeaks has added into the RustyRocket toolset, even well-instrumented environments may struggle to get a clear line of sight. However, Accenture is helping clients better detect and track this threat.

Detection demands a different approach

Here's the good news: RustyRocket does leave traces. Unique TLS fingerprints, abnormal server name indication values, and nested encryption patterns are all detectable, but only if you're looking for them holistically, using multiple weaker traces rather than waiting for a single definitive alert.

That's why Accenture is helping clients implement novel detection and hunt techniques to more rapidly detect, prevent, and contain the malware. It reflects a broader truth about modern threat detection: as malware grows more evasive, detection has to grow more sophisticated as well. Single-point indicators are no longer enough.

What this means for your organization

RustyRocket's evolution is a case study in how extortion-driven operations are professionalizing. Malware is no longer static, but maintained, iterated, and reused across campaigns by threat actors who think like product managers.

Defenders need to respond in kind. That means:

• Enhanced network visibility focused on anomalous encrypted traffic, particularly layered TLS patterns and connections to unknown or dynamically generated domains.
• Behavioral detection using tools like JA3/JA4 fingerprinting alongside traditional signature-based approaches.
• Continuous validation through adversary simulation and red teaming to ensure detection capabilities keep pace with evolving adversary tradecraft.
• Threat hunting that treats weak correlated signals as meaningful, not noise.

The organizations best positioned to defend against platforms like RustyRocket are those that have moved away from static, event-driven security operations toward continuous, intelligence-led monitoring. The threat environment has professionalized. Defensive strategies need to keep pace.

The threat landscape has shifted. WorldLeaks, a ransomware group that emerged in early 2025 from the former Hunters International operation, represents a potentially dangerous evolution in cyber extortion tactics, having abandoned traditional ransomware encryption entirely. Instead of encrypting victim data and demanding payment for decryption keys, WorldLeaks affiliates simply steal sensitive corporate and personal data, then threaten to publish it unless their demands are met.

This approach is strategically significant. Traditional ransomware operations are increasingly thwarted by improved backup practices and decryption tools. WorldLeaks has sidestepped these defenses by recognizing that the threat of public data exposure can be equally, if not more, coercive than locked systems. There is generally no technical recovery path when the damage is reputational and regulatory rather than operational.

Central to WorldLeaks' operations is a sophisticated data exfiltration and proxy tool discovered by Accenture Cybersecurity during a 2025 engagement that we have given the name “RustyRocket.” Written in Rust and designed for both Windows and Linux environments, RustyRocket enables WorldLeaks affiliates to steal data through heavily obfuscated, multi-layered encrypted tunnels that can be exceptionally difficult to detect using traditional network monitoring.

RustyRocket's technical sophistication is notable: it uses TLS wrapped inside TLS, custom protocol framing, and runtime configuration guardrails that prevent analysis in automated security sandboxes. The malware can also chain through multiple infected hosts, allowing attackers to proxy stolen data through internal networks before exfiltration, effectively bypassing perimeter controls.

Organizations targeted by WorldLeaks face a stark reality: once data leaves the network, there is generally no technical remediation. Unlike ransomware encryption, which can sometimes be reversed, stolen data cannot be "un-stolen." Victims must weigh the costs of potential regulatory penalties, litigation exposure, customer notification requirements, and lasting reputational damage against extortion demands.

Leadership should ensure their organizations can detect anomalous outbound data transfers, implement network segmentation to limit lateral movement, and deploy the detection signatures provided in this report. The shift from encryption-based attacks to pure data theft demands a corresponding shift in defensive priorities: preventing exfiltration must be as critical as preventing encryption.

• WorldLeaks affiliates have been observed using a new sophisticated malware family called RustyRocket for proxying traffic between hosts and exfiltrating data.
• RustyRocket provides multi-layered encrypted command and control capabilities that are difficult to detect via traditional methods.
• RustyRocket can serve as both a client and server using the same executable.
• RustyRocket employs a novel execution guardrail of requiring the user to input a pre-encrypted configuration at runtime. This hinders malware analysis of its functionality as the configuration is not embedded in the malware itself.
• RustyRocket contains an internal list of approximately 1000 names that can be randomly selected to be used as subdomains for Command & Control (C2) network traffic.

During an Accenture Cybersecurity engagement in 2025, consultants identified a suspicious file linked to hands-on-keyboard activity from a WorldLeaks ransomware affiliate. WorldLeaks first emerged in early 2025, appearing to rebranding from the former Hunters International Ransomware-as-a-Service (RaaS) group. We assess that the same operators are behind both groups, although WorldLeaks pivoted away from deploying ransomware and now focuses primarily on stealing and publicly exposing sensitive data for extortion. They target a range of industries, with a particular focus on North American organizations in the industrial, healthcare, and professional services sectors.

When WorldLeaks launched its RaaS operation in early 2025, it provided affiliates with a custom data exfiltration tool¹ written in the Rust programming language, which Accenture Cybersecurity strongly believes is the RustyRocket malware family. Both WorldLeaks and Hunters International are known for leveraging Rust-based malware for their attacks. Security researchers have reported that Hunters International itself likely evolved from the earlier Hive ransomware group², which transitioned from a ransomware written in the GoLang programming language to one written in Rust in 2022³. This lineage highlights how these interconnected ransomware groups have steadily adopted and improved advanced Rust-based malware tools over time.

WorldLeaks affiliates typically gain initial network access via social engineering, stolen credentials, or exploiting exposed infrastructure. Once inside a victim’s environment, they conduct extensive reconnaissance to locate valuable corporate or personal data for exfiltration. After the data is stolen, they threaten to publish it on their data leak site unless the victim pays their demands. The WorldLeaks data leak site (DLS) is very similar in design and functionality to the one used by Hunters International, featuring four main sections: the main leak portal, a negotiation site for victims, an “Insider” platform for journalists, and an affiliate panel.

1. https://www.group-ib.com/blog/hunters-international-ransomware-group
2. https://www.acronis.com/en/tru/posts/hunters-international-new-ransomware-based-on-hive-source-code
3. https://www.microsoft.com/en-us/security/blog/2022/07/05/hive-ransomware-gets-upgrades-in-rust

This analysis is primarily based on the analysis of a RustyRocket malware sample named “winhost.exe” that was written using the Rust programming language for the Windows operating system. Its sha256 file hash is 36255601ca5d6882d34c0d53a5a816ef0b979828038f9caf5f1a2afdfcffc329 and to date it is our most representative sample of the RustyRocket malware family. Accenture Cybersecurity also found 14 additional Windows samples and two Linux samples of the RustyRocket malware family in VirusTotal with compile timestamps ranging from 2025-01-13 20:44:56 UTC to 2025-12-17 05:49:42 UTC. The hashes are listed below.

The following samples include the RustyRocket agent for Windows and Linux, RustyRocket proxies, and the RocketLaunch service installer tool.

587d343b3d9e1201ba5a8fdd7a3a3f809052aa7dfba3f7c557189ef63a999f08
961b6184447ab4cb76295ea2f324e227aff459d0e68849c46c49ecdf641e2551
36255601ca5d6882d34c0d53a5a816ef0b979828038f9caf5f1a2afdfcffc329
67b487ddd924e078144bb9e2c48fe8b7924221f1e55c3f2df67d65daa3415fd4
6034d6aa9a13378be6cd611cb5495b50eb7dc8463ef435e3b6d8c68a57e9b8e1
5b9017e700d3dd26e18043fb6e041241c704bcc08608a9f5898212dc7e722198
0e63a49230d6ad3c05b57c9b35eb98b21f75cc15ff135008c1087c69478beea6
e7ad1b1974e8f04949936545d1297c4e3b1334a9da0ae31ab1d508174197bbce
98dc0cd6290566866f3b1682335c680b9bbdb1020fc52e47315fd33eb9fa221e
8b37116210f70e7768c736d657fcc143a1f009c9a69194ccc338d6e8dedb3c07
88553c3e3df81a66927480fd1029d577c7805c0dd20114807a6f41b50a230e96
041dca4a1d8c80f05c399dd750acf026ed5f94f1da08dc4f0f0d0ba9884916ff
63150c955be4158c9b9e111de114daa59a4ffd1eab92a469c1f09dce84a698c6
a30609489c111decdd3f8693cff016d9a8f629a0d85fdac858add7698f9b2659
c1b67a62239f328b98f9d2a168565754b6779918ddaab74bb58020b95f3ec7cc
180a40b7758b9b053f7f3f41511275f94b01eee88dd9b93edf003a607ee655a0

d92377d14dc2c3cd818fcf3a37343ec30a3495b9ba2eedaa2d41b698ee159b08
c5ffa5ac08f0feba11d767d1b2d8b096b729e90cc2874e0c8f624a5a68466131

Effective RustyRocket detection and mitigation requires a combination of file, memory, and network detections. APEX Labs recommends the following measures:

• Scan for Windows and Linux RustyRocket samples within your network using the YARA rules provided in this report.
• Monitor for unexpected TLS network connections between hosts that do not regularly communicate.
• Alert on TLS network traffic containing invalid SNI values such as "server", "router", or "proxy".
• Leverage the JA4 and JA3 fingerprints in the Network Fingerprints section below to alert on potential RustyRocket network traffic.
• Monitor for increases in TLS network traffic to unknown domain names, especially those utilizing subdomains like RustyRocket's randomized subdomain list.
• If capable, strip TLS from captured network traffic and look for unexpected WebSocket connections or TLS traffic nested within the outer TLS layer.

Use the following TLS client fingerprints to detect potential RustyRocket C2 network traffic. Integrate into your NDR or SIEM alerting pipeline.

Example decrypted config

{
    "gateways": [
        {
            "mode": "direct",
            "addrs": [
                "192.168.1.1",
                "198.168.2.1"
            ],
            "cidrs": [
                "192.168.1.0/24",
                "192.168.2.0/24"
            ],
            "port": 443,
            "ech": null,
            "subdomain": "randomize",
            "domains": [
                "example.com",
                "test.com"
            ]
        }
    ],
    "access_token": "abc123"
}

Example AES256-CTR encrypted config

• Partial Key: 908e6696f4
• Counter: 0f0e0d0c
• Nonce: 0b0a09080706050403020100

Ciphertext:

908e6696f405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f0f0e0d0c0b0a09080706050403020100f278bc3f082fd853dc6f5a26b1af3a45b8e64fb4428c5239f7750998b6db516c2dcfa2be70963d845f84020c45a4f93f6ec962fa951d3c63bb78971c8786f519884b757eef74008845a2bc0f8223d8aef1e2400dd306dd370ec370f2e594ead32751bee5b35df5ddf1b1e153855d403977ad0980864c43e0da8cb1e56231eeffa400c2fa97f98deb91646b211c5ae101c10794bc50942f08a6da12447ee1d21a7c7a74c88ff4d653f1552a837fc8b254f5a859f1d43260a81f0a247d836f719b6af8b2779855bce7b79237e12118a1116047da568e92b0684333d3179b55eb47b5918eeb7e920956e357f57184af97ad404eeda2a2de97a58f2bf07da97444a2065aeab92c94707e0609164d0d4119fc81667b9336608c6f9c7b6159b4d1a8888ba9e870b24f7ee074be7c743ecbb664f1f81e248ac830cfe22fa32dddba23a8ce0ce589f8c66c235cf3ccb1192a15a9633f87029d0f8ed30af6f25a8f9e51ab2f91cc477209695db96f25cb8bc91879204676a7513dcf95a513fce6bfeef5cd725543f0d3efa976f73c5309341ca905616183af12d8cca9c9617e9b3ab5c6ebcb25ec5df941741754cae7cfa71b03a15e6d7c87bcd22744a9cecc6d0bc438c2cb6d29ec7535c66c0f20c99a23ecac0eddf40959e97bb1807c53c29f39692b602000ad9d42d640add7a2922a98aa41c5

Example AES256-CTR encrypted config encoded in Base64

(What is pasted into the RustyRocket console at runtime)

kI5mlvQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8PDg0MCwoJCAcGBQQDAgEA8ni8Pwgv2FPcb1omsa86RbjmT7RCjFI593UJmLbbUWwtz6K+cJY9hF+EAgxFpPk/bsli+pUdPGO7eJcch4b1GYhLdX7vdACIRaK8D4Ij2K7x4kAN0wbdNw7DcPLllOrTJ1G+5bNd9d3xseFThV1AOXetCYCGTEPg2oyx5WIx7v+kAML6l/mN65FkayEcWuEBwQeUvFCULwim2hJEfuHSGnx6dMiP9NZT8VUqg3/IslT1qFnx1DJgqB8KJH2Db3Gbaviyd5hVvOe3kjfhIRihEWBH2laOkrBoQzPTF5tV60e1kY7rfpIJVuNX9XGEr5etQE7toqLel6WPK/B9qXREogZa6rkslHB+BgkWTQ1BGfyBZnuTNmCMb5x7YVm00aiIi6nocLJPfuB0vnx0Psu2ZPH4HiSKyDDP4i+jLd26I6jODOWJ+MZsI1zzzLEZKhWpYz+HAp0PjtMK9vJaj55Rqy+RzEdyCWlduW8ly4vJGHkgRnanUT3PlaUT/Oa/7vXNclVD8NPvqXb3PFMJNBypBWFhg68S2MypyWF+mzq1xuvLJexd+UF0F1TK58+nGwOhXm18h7zSJ0SpzsxtC8Q4wsttKex1NcZsDyDJmiPsrA7d9AlZ6XuxgHxTwp85aStgIACtnULWQK3XopIqmKpBxQ==