# Double-Claimed Ransomware Victims: Same Victim Listed Under Two Groups on Leak Sites (2026 Trend)

> Bitdefender analysed five months of leak-site data and found 98 claims covering 49 distinct victims, each claimed by exactly two different ransomware groups. It attributes the overlap to five causes: one operator using two brands, re-extorted data, two genuine breaches, access-broker resale, and fabricated claims. Fabricated 0APT postings (549 claimed victims) inflated Q1 2026 claimed-victim totals.

- **Published:** 2026-10-22T09:54:21Z
- **Last reviewed:** 2026-10-22T09:54:21Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4130
- **ID:** TL-2026-4130
- **Severity:** MEDIUM
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 14 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Bitdefender Business Insights (Gabriel Macovei, 2026-06-17) examined a deliberately curated set of confirmed duplicate leak-site claims: 98 claims covering 49 victims, each listed by exactly two groups. The median gap between the first and second claim was 12 days, the mean about 23 days and the maximum 96 days. Five victims were claimed on the same day, 16 within 1-7 days, 12 within 8-30 days and 16 after 31 or more days. Bitdefender notes the dataset is not a random sample of all ransomware victims, and that group attribution rests on the groups' own leak-site labels, which is the very signal the piece argues is unreliable.

The article gives five explanations for a double claim. (1) One attacker operates under two group names: Qilin, DragonForce-cartel affiliates, and the Hunters International to World Leaks rebrand. (2) The same data is re-extorted: an unpaid affiliate resells stolen data elsewhere; the Change Healthcare data was allegedly posted by both ALPHV/BlackCat and RansomHub weeks apart. (3) Two genuine, separate breaches of the same organisation, often indicating inadequate remediation after the first incident. (4) Access-broker resale, where initial-access credentials from one breach are sold to several independent actors. (5) Fabricated claims, where groups invent or plagiarise victims without access. Groups named in the data include DragonForce, Qilin, RansomHub, Devman, Hunters International/World Leaks, ALPHV/BlackCat, 0APT, KryBit, LockBit, Cl0p, Beast, The Gentlemen and Dispossessor. Beast and The Gentlemen each appeared before Qilin on three victims and Devman before DragonForce on three. LockBit posted data labelled as Federal Reserve data that was actually Evolve Bank, and Dispossessor reposted victims first listed by Cl0p, LockBit and Hunters International.

0APT is the clearest fabrication case. It launched its leak site on 2026-01-28 with 200+ claimed victims (Bitdefender cites 91 victims in 48 hours in January and 458 in February, 549 in total). GuidePoint Research and Intelligence Team (GRIT) found most of the victims had never been attacked, and that the site streamed random data from /dev/random to the browser to simulate a roughly 20GB download. In mid-April 2026 the rival group KryBit breached 0APT's infrastructure, published access logs, PHP source and system files, and defaced the site; 0APT in turn exposed KryBit data (Halcyon reporting). Q1 2026 claimed victims were 3,014, up 15% from 2,616 in Q1 2025; excluding 0APT's 549 fabricated claims the figure shows a decline of about 6%.

Defensive implications: the article recommends that responders verify that leak samples exist and are authentic, check whether the data matches an earlier leak (re-extortion), assess any link between the claiming groups, determine whether security posture changed since the first claim, and consult legal counsel on disclosure obligations. Whether a second claim is a new breach or an echo of the old one changes the technical response. The source contains no CVEs, CVSS data or technical IOCs such as IPs, domains or hashes; the IOC list below records the named actors and observable behaviours only. Severity MEDIUM is an analyst judgement.

## MITRE ATT&CK

- T1657 Financial Theft
- T1567 Exfiltration Over Web Service
- T1650 Acquire Access
- T1078 Valid Accounts
- T1491.002 External Defacement

## Sources

- [Claimed Twice: Five Reasons the Same Ransomware Victim Shows Up Under Two Flags (Bitdefender)](https://www.bitdefender.com/en-us/blog/businessinsights/claimed-twice-five-reasons-same-ransomware-victim-appears-under-two-flags)
- [Feuding Ransomware Groups Leak Each Other's Data, Exposing Operations to Defenders (Security Boulevard, citing Halcyon)](https://securityboulevard.com/2026/04/feuding-ransomware-groups-leak-each-others-data-exposing-operations-to-defenders/)
- [Infosec Experts Say the 0APT Group Is Fake (Hackmag)](https://hackmag.com/news/0apt)
- [0APT ransomware crew makes embarrassing splash (Computer Weekly)](https://www.computerweekly.com/news/366639164/0APT-ransomware-crew-makes-embarrassing-splash)
- [Fake-Out: 0APT Data Leak Ransomware Group Branded Scam (BankInfoSecurity)](https://www.bankinfosecurity.com/fake-out-0apt-data-leak-ransomware-group-branded-scam-a-30726)
- [0APT ransomware crew makes embarrassing splash (GuidePoint Security / GRIT)](https://www.guidepointsecurity.com/newsroom/0apt-ransomware-crew-makes-embarrassing-splash/)
- [Hunters International rebrands as World Leaks in shift to data extortion (BleepingComputer)](https://www.bleepingcomputer.com/news/security/hunters-international-rebrands-as-world-leaks-in-shift-to-data-extortion/)
- [Change Healthcare and RansomHub redefine double extortion (Barracuda)](https://blog.barracuda.com/2024/04/12/change-healthcare-and-ransomhub-redefine-double-extortion)
- [Devman ransomware tracker (WatchGuard)](https://www.watchguard.com/node/104041)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4130