Threat reportRansomwareTL-2026-4130
Double-Claimed Ransomware Victims: Same Victim Listed Under Two Groups on Leak Sites (2026 Trend)
Double-Claimed Ransomware Victims (TL-2026-4130), also tracked as Double-claimed ransomware victims, is a medium-severity ransomware operation, first published 2026-10-22. It has no confirmed attribution, affects Various Organizations listed on ransomware leak sites, maps to 5 MITRE ATT&CK techniques (T1078, T1491.002, T1567), and is covered by 9 detection rules and 14 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 5MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 14Indicators of compromise
Key facts for TL-2026-4130
- Threat ID
- TL-2026-4130
- Also known as
- Double-claimed ransomware victims, Claimed Twice
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- health, finance, government administration, multiple
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 14
Malware and tooling in Double-Claimed Ransomware Victims
Malware and tooling: 0apt, AgendaCrypt, BlackCat (Windows), BlackCat - S1068, Clop, DEVMAN, LockBit, RansomHub - S1212, beast, dispossessor, hunters, worldleaks
How Double-Claimed Ransomware Victims works
Bitdefender analysed five months of leak-site data and found 98 claims covering 49 distinct victims, each claimed by exactly two different ransomware groups. It attributes the overlap to five causes: one operator using two brands, re-extorted data, two genuine breaches, access-broker resale, and fabricated claims. Fabricated 0APT postings (549 claimed victims) inflated Q1 2026 claimed-victim totals.
Bitdefender Business Insights (Gabriel Macovei, 2026-06-17) examined a deliberately curated set of confirmed duplicate leak-site claims: 98 claims covering 49 victims, each listed by exactly two groups. The median gap between the first and second claim was 12 days, the mean about 23 days and the maximum 96 days. Five victims were claimed on the same day, 16 within 1-7 days, 12 within 8-30 days and 16 after 31 or more days. Bitdefender notes the dataset is not a random sample of all ransomware victims, and that group attribution rests on the groups' own leak-site labels, which is the very signal the piece argues is unreliable.
The article gives five explanations for a double claim. (1) One attacker operates under two group names: Qilin, DragonForce-cartel affiliates, and the Hunters International to World Leaks rebrand. (2) The same data is re-extorted: an unpaid affiliate resells stolen data elsewhere; the Change Healthcare data was allegedly posted by both ALPHV/BlackCat and RansomHub weeks apart. (3) Two genuine, separate breaches of the same organisation, often indicating inadequate remediation after the first incident. (4) Access-broker resale, where initial-access credentials from one breach are sold to several independent actors. (5) Fabricated claims, where groups invent or plagiarise victims without access. Groups named in the data include DragonForce, Qilin, RansomHub, Devman, Hunters International/World Leaks, ALPHV/BlackCat, 0APT, KryBit, LockBit, Cl0p, Beast, The Gentlemen and Dispossessor. Beast and The Gentlemen each appeared before Qilin on three victims and Devman before DragonForce on three. LockBit posted data labelled as Federal Reserve data that was actually Evolve Bank, and Dispossessor reposted victims first listed by Cl0p, LockBit and Hunters International.
0APT is the clearest fabrication case. It launched its leak site on 2026-01-28 with 200+ claimed victims (Bitdefender cites 91 victims in 48 hours in January and 458 in February, 549 in total). GuidePoint Research and Intelligence Team (GRIT) found most of the victims had never been attacked, and that the site streamed random data from /dev/random to the browser to simulate a roughly 20GB download. In mid-April 2026 the rival group KryBit breached 0APT's infrastructure, published access logs, PHP source and system files, and defaced the site; 0APT in turn exposed KryBit data (Halcyon reporting). Q1 2026 claimed victims were 3,014, up 15% from 2,616 in Q1 2025; excluding 0APT's 549 fabricated claims the figure shows a decline of about 6%.
Defensive implications: the article recommends that responders verify that leak samples exist and are authentic, check whether the data matches an earlier leak (re-extortion), assess any link between the claiming groups, determine whether security posture changed since the first claim, and consult legal counsel on disclosure obligations. Whether a second claim is a new breach or an echo of the old one changes the technical response. The source contains no CVEs, CVSS data or technical IOCs such as IPs, domains or hashes; the IOC list below records the named actors and observable behaviours only. Severity MEDIUM is an analyst judgement.
MITRE ATT&CK techniques used in TL-2026-4130
Initial Access
Impact
T1491.002 External Defacement; T1657 Financial Theft
Exfiltration
T1567 Exfiltration Over Web Service
Resource Development
Affected products and versions in Double-Claimed Ransomware Victims
- Various — Organizations listed on ransomware leak sites
Remediation for Double-Claimed Ransomware Victims
Immediate actions
- Verify that the leak-site sample exists and is authentic before treating a claim as a confirmed breach
- Compare the claimed data with any earlier leak to determine whether it is re-extorted material
- Check whether the two claiming groups are linked (shared affiliates, rebrand, cartel)
- Consult legal counsel on disclosure obligations
Longer-term hardening
- Remediate the root cause of the first incident fully, since a second genuine breach often follows inadequate remediation
- Rotate credentials and revoke sessions after any intrusion to counter access-broker resale
- Monitor leak sites for the organisation's name and treat group labels as unreliable attribution
- Treat claimed-victim counts as upper bounds in reporting because fabricated claims inflate them
Timeline of Double-Claimed Ransomware Victims
- Barracuda reports RansomHub claiming Change Healthcare data after ALPHV/BlackCat's earlier claim, a precedent for double-claimed victims cited by Bitdefender
- Hunters International relaunches as the extortion-only World Leaks, an example of one operator under two names
- 0APT launches its leak site with 200+ claimed victims, later shown to be fabricated
- 0APT leak site goes offline after expert scrutiny of its claims
- 0APT site returns with its victim list reduced to 15 organisations; GuidePoint GRIT finds the claimed downloads served random data from /dev/random
- Around mid-April 2026 (exact day not stated in the source), KryBit breaches 0APT's infrastructure, publishes access logs and PHP source, and defaces its leak site
- Security Boulevard publishes Halcyon-based reporting on the 0APT and KryBit feud
- Bitdefender publishes the analysis of 98 double claims covering 49 victims, with a median gap of 12 days
Sources cited for Double-Claimed Ransomware Victims
- Claimed Twice: Five Reasons the Same Ransomware Victim Shows Up Under Two Flags (Bitdefender)
- Feuding Ransomware Groups Leak Each Other's Data, Exposing Operations to Defenders (Security Boulevard, citing Halcyon)
- Infosec Experts Say the 0APT Group Is Fake (Hackmag)
- 0APT ransomware crew makes embarrassing splash (Computer Weekly)
- Fake-Out: 0APT Data Leak Ransomware Group Branded Scam (BankInfoSecurity)
- 0APT ransomware crew makes embarrassing splash (GuidePoint Security / GRIT)
- Hunters International rebrands as World Leaks in shift to data extortion (BleepingComputer)
- Change Healthcare and RansomHub redefine double extortion (Barracuda)
- Devman ransomware tracker (WatchGuard)
Detection coverage for TL-2026-4130
As of 2026-10-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4130 across Splunk SPL, Microsoft KQL and Sigma, covering 14 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.