# Ransomware Double-Claiming: Why the Same Victim Appears on Two Leak Sites

> Bitdefender's analysis of 98 ransomware leak-site claims across 49 organizations (Jan-Jun 2026) shows victims are frequently claimed by two different groups for five distinct reasons - shared-affiliate rebranding, unpaid-affiliate re-extortion, genuine repeat breaches, access-broker credential resale, and outright fabrication. Stripping out 0APT's 549 fabricated victims alone flips the apparent Q1 2026 ransomware victim growth rate from +15% YoY to -6% YoY.

- **Published:** 2026-06-17T00:00:00Z
- **Last reviewed:** 2026-06-17T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2248
- **ID:** TL-2026-2248
- **Severity:** INFORMATIONAL
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Bitdefender's Business Insights team curated a dataset of 98 leak-site claims spanning 49 distinct victim organizations posted between January and June 2026, deliberately selecting cases where the same organization (matched by name and root domain) was claimed by two different ransomware brands. The analysis identifies five non-exclusive mechanisms driving double-claims: (1) a single criminal operation running multiple brand names on shared infrastructure - e.g., the DragonForce cartel absorbing displaced RansomHub affiliates after RansomHub's April 2025 collapse, Qilin's 'gravitational pull' on the same affiliate pool, and Hunters International's identical-infrastructure rebrand into the data-extortion-only World Leaks; (2) data re-extortion, where an affiliate left unpaid by one operator (the ALPHV/BlackCat exit-scam after the Change Healthcare ransom) takes the same stolen dataset to a second brand (RansomHub) for a fresh shakedown, with a median 12-day gap between postings; (3) genuine repeat breaches, where an organization patches the originally exploited flaw but leaves systemic weaknesses (weak identity controls, flat networks, no monitoring) in place, letting a second, unrelated actor - or an access broker reselling credentials from the first breach - get back in (16 of 49 cases show 31+ day gaps consistent with separate incidents); (4) cartel/shared-infrastructure claims, where multiple affiliated brands (Beast preceding Qilin three times, The Gentlemen appearing three times, Devman handing off to DragonForce three times) each independently post the same breach; and (5) outright fabrication or false attribution, exemplified by the RaaS group 0APT posting 91 fake victims within 48 hours in January 2026 and a further 458 the following month (549 total) before rival group KryBit hacked 0APT's own infrastructure in April 2026, confirmed no data had ever been exfiltrated from the listed victims, and defaced 0APT's leak site. Removing just 0APT's fabricated claims from the Q1 2026 headline count (3,014 victims, +15% YoY) drops the total to 2,465 victims, a -6% YoY decline - demonstrating that a single fabricating brand can singlehandedly invert a widely reported industry trend line. The piece also cites LockBit's post-Operation Cronos claim of a US Federal Reserve breach that turned out to be recycled Evolve Bank & Trust data, and Dispossessor's wholesale reposting of existing Cl0p, LockBit, and Hunters International victim lists without any original access, as further fabrication/false-attribution precedents. Bitdefender's conclusion: raw leak-site victim counts are an unreliable threat-intel metric without de-duplication, and organizations facing a second claim against an already-remediated incident need a structured triage process (verify proof, compare data samples, assess group/cartel relationships, evaluate what security changes occurred since the first breach) rather than treating every claim as a new, independent intrusion requiring full incident response and separate ransom consideration.

## MITRE ATT&CK

- T1650 Acquire Access
- T1583 Acquire Infrastructure
- T1588.002 Obtain Capabilities: Tool
- T1078 Valid Accounts
- T1133 External Remote Services
- T1021 Remote Services
- T1005 Data from Local System
- T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage
- T1657 Financial Theft
- T1491.002 Defacement: External Defacement

## Sources

- [Claimed Twice: Five Reasons the Same Ransomware Victim Appears Under Two Flags](https://www.bitdefender.com/en-us/blog/businessinsights/claimed-twice-five-reasons-same-ransomware-victim-appears-under-two-flags)
- [Infighting in the Ransomware Scene: 0APT vs. KryBit Leads to Data Leaks](https://www.thaicert.or.th/en/2026/04/30/infighting-in-the-ransomware-scene-0apt-vs-krybit-leads-to-data-leaks/)
- [Ransomware Turf War as 0APT and KryBit Groups Trade Blows](https://www.infosecurity-magazine.com/news/ransomware-turf-war-0apt-krybit/)
- [0APT vs. KryBit Ransomware Actors List Opposing Operators as Victims](https://www.halcyon.ai/ransomware-research-reports/0apt-vs-krybit-ransomware-actors-list-opposing-operators-as-victims)
- [Hunters International Rebrands as World Leaks in Shift to Data Extortion](https://www.bleepingcomputer.com/news/security/hunters-international-rebrands-as-world-leaks-in-shift-to-data-extortion/)
- [Hunters International Said Ransomware Now 'Too Risky'](https://www.theregister.com/2025/04/02/hunters_international_rebrand/)
- [RansomHub Went Dark April 1; Affiliates Fled to Qilin, DragonForce Claimed Control](https://thehackernews.com/2025/04/ransomhub-went-dark-april-1-affiliates.html)
- [DragonForce: The Ransomware Cartel Guarding Its Burrow](https://www.bitdefender.com/en-us/blog/businessinsights/dragonforce-ransomware-cartel)
- [Change Healthcare and RansomHub Redefine Double Extortion](https://blog.barracuda.com/2024/04/12/change-healthcare-and-ransomhub-redefine-double-extortion)
- [Second Ransomware Group Extorting Change Healthcare](https://www.securityweek.com/second-ransomware-group-extorting-change-healthcare/)
- [LockBit Holds Its Word, Publishes US Federal Reserve Alleged Data](https://cybernews.com/news/lockbit-ransomware-us-federal-reserve-published/)
- [LockBit Lied: Stolen Data Is From a Bank, Not US Federal Reserve](https://www.bleepingcomputer.com/news/security/lockbit-lied-stolen-data-is-from-a-bank-not-us-federal-reserve/)
- [Qilin Ransomware Ranked Highest in April 2025 with 72 Data Leak Disclosures](https://thehackernews.com/2025/05/qilin-leads-april-2025-ransomware-spike.html)
- [No Manners Here: The Ruthless Rise of The Gentlemen Ransomware](https://unit42.paloaltonetworks.com/the-gentlemen-ransomware/)
- [FBI Disrupts the Dispossessor Ransomware Operation, Seizes Servers](https://www.bleepingcomputer.com/news/security/fbi-disrupts-the-dispossessor-ransomware-operation-seizes-servers/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2248