# Duplicate Ransomware Leak-Site Claims: RaaS Cartels, Affiliate Re-Extortion, Access-Broker Resale, and Fabrication (Bitdefender 'Claimed Twice')

> Bitdefender's June 2026 'Claimed Twice' analysis documents five structural reasons the same victim is posted on two ransomware leak sites and shows how fabricated claims (notably 0APT's 549 fake Q1-2026 victims, exposed when rival KryBit hacked 0APT) distort ecosystem statistics. The concrete cases it cites — the ALPHV/BlackCat-to-RansomHub re-extortion of Change Healthcare and the 0APT/KryBit feud — map to a real ransomware-as-a-service extortion kill chain spanning access brokers, affiliate movement, data theft, double extortion, and leak-site fabrication.

- **Published:** 2026-06-17T00:00:00Z
- **Last reviewed:** 2026-06-17T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0843
- **ID:** TL-2026-0843
- **Severity:** INFO
- **Category:** THREAT_INTEL
- **Status:** TRACKING
- **Detections:** 9 · **IOCs:** 17 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-06-17 Bitdefender published 'Claimed Twice', an analysis of a measurement problem in ransomware reporting: victim organizations increasingly appear on multiple ransomware data-leak sites (DLS) under different group flags, making leak-site counts unreliable. Across January-June 2026 the researchers counted 98 duplicate leak-site claims spanning 49 distinct organizations (every one posted twice), with a median gap of 12 days, a mean of ~23 days, and a maximum gap of 96 days between first and second posting (5 same-day, 16 within the first week, 12 in the 8-30 day band, 16 at 31+ days). Qilin alone accounted for 20 of the 98 claims.

The report identifies five structural causes: (1) one attacker, two groups — ransomware-cartel operations and rebrands where affiliates work across multiple brands and share infrastructure; (2) same data, claimed again — affiliate non-payment and re-extortion / data resale, exemplified by the ALPHV/BlackCat affiliate who, after BlackCat's exit scam following Change Healthcare's USD 22M payment, took the retained data to RansomHub for a second extortion attempt; (3) two real breaches — genuinely distinct intrusions of the same victim by unrelated groups; (4) access-broker resale — an initial-access broker (IAB) selling the same foothold/credentials to multiple operators; and (5) no breach at all — outright fabrication and wholesale plagiarism of victim lists.

The headline data point is 0APT: the group emerged in late January 2026 posting 91 victims in 48 hours and 458 the following month, but the claims were fabricated — over 180 zip filenames referenced organizations like Boeing, Goldman Sachs, and Mayo Clinic yet every download returned HTTP 502. In April 2026 rival group KryBit hacked 0APT, defaced its leak site ('Next time, don't play with the big boys'), and dumped 0APT's full operational dataset including access logs, PHP source, and system files, revealing infrastructure running AnLinux-Parrot OS serving content from an Android phone's internal SD card. Removing 0APT's 549 fabricated claims from Q1 2026 reverses the apparent trend from 3,014 claimed victims (+15% YoY) to 2,465 (~-6% YoY) — 'one fabricated brand is the entire distance between ransomware surged and ransomware fell.' This record is filed as THREAT_INTEL: the source carries no CVE, CVSS, or affected product/version, but the named cartels, the documented ALPHV→RansomHub chain, the IAB resale model, and the 0APT/KryBit feud are corroborated, trackable adversary behaviors with defensive and analytic value.

## MITRE ATT&CK

- T1591 Gather Victim Org Information
- T1650 Acquire Access
- T1583 Acquire Infrastructure
- T1585 Establish Accounts
- T1587 Develop Capabilities
- T1608 Stage Capabilities
- T1078 Valid Accounts
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1566 Phishing
- T1555 Credentials from Password Stores
- T1482 Domain Trust Discovery
- T1685 Disable or Modify Tools
- T1021 Remote Services
- T1213 Data from Information Repositories
- T1567 Exfiltration Over Web Service
- T1048 Exfiltration Over Alternative Protocol
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery
- T1657 Financial Theft
- T1491 Defacement

## Sources

- [Claimed Twice: Five Reasons the Same Ransomware Victim Appears Under Two Flags](https://www.bitdefender.com/en-gb/blog/businessinsights/claimed-twice-five-reasons-same-ransomware-victim-appears-under-two-flags)
- [Ransomware Turf War as 0APT and KryBit Groups Trade Blows](https://www.infosecurity-magazine.com/news/ransomware-turf-war-0apt-krybit/)
- [Feuding Ransomware Groups Leak Each Other's Data](https://www.darkreading.com/threat-intelligence/feuding-ransomware-groups-leak-data)
- [0APT vs. KryBit Ransomware Actors List Opposing Operators as Victims](https://www.halcyon.ai/ransomware-research-reports/0apt-vs-krybit-ransomware-actors-list-opposing-operators-as-victims)
- [KryBit retaliates against 0APT with extensive data leak](https://www.scworld.com/brief/krybit-retaliates-against-0apt-with-extensive-data-leak)
- [Change Healthcare and RansomHub redefine double extortion](https://blog.barracuda.com/2024/04/12/change-healthcare-and-ransomhub-redefine-double-extortion)
- [Change Healthcare stolen patient data leaked by ransomware gang](https://techcrunch.com/2024/04/15/change-healthcare-stolen-patient-data-ransomhub-leak/)
- [Change Healthcare discloses USD 22M ransomware payment](https://www.ibm.com/think/news/change-healthcare-22-million-ransomware-payment)
- [BlackCat Goes Dark After Ripping Off Change Healthcare Ransom](https://www.darkreading.com/cyberattacks-data-breaches/blackcat-goes-dark-again-reportedly-rips-off-change-healthcare-ransom)
- [How the ransomware attack at Change Healthcare went down: A timeline](https://techcrunch.com/2025/01/27/how-the-ransomware-attack-at-change-healthcare-went-down-a-timeline/)
- [Feuding Ransomware Groups Leak Each Other's Data, Exposing Operations to Defenders](https://securityboulevard.com/2026/04/feuding-ransomware-groups-leak-each-others-data-exposing-operations-to-defenders/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0843